The United States' National Counterintelligence and Security Center (NCSC) has warned that China's updated Counter-Espionage law – which came into effect on July 1 – is dangerously ambiguous and could pose a risk to global business.

US cyber ambassador says China knows how to steal its way to dominance of cloud and AI [1]READ MORE

The NCSC publishes non-classified bulletins titled "Safeguarding Our Future" on an ad hoc schedule to "provide a brief overview of a specific foreign intelligence threat, as well as impacts of that threat and steps for mitigation."

On June 30 it issued [2]a new one [PDF] titled "US Business Risk: People's Republic of China (PRC) Laws Expand Beijing's Oversight of Foreign and Domestic Companies." The first item discussed is China's recently revised Counter-Espionage Law, on grounds it "Expands the definition of espionage from covering state secrets and intelligence to any documents, data, materials, or items related to national security interests, without defining terms."

That vagueness, the Center argues, means "Any documents, data, materials, or items could be considered relevant to PRC national security due to ambiguities in the law" and adds up to potential "legal risks or uncertainty for foreign companies."

Should you therefore think hard before reading email from your China office, or Chinese partners?

[3]

Probably not. in May, China Law Translate – a crowdsourced translation and analysis service for Chinese laws – in May [4]rated the updated law "probably less consequential than some imagine."

[5]

[6]

"Many of the amendments incorporate previously released legal authority that has already gradually expanded counter-espionage work and powers since the law was adopted in 2014," wrote Jeremy Daum, a senior fellow at Yale Law School's Paul Tsai China Center, in Beijing, and the founder of China Law Translate.

[7]China makes it even harder for data to leave its shores

[8]China's cyberspace regulator details data export requirements

[9]China puts continuous consent at the center of data protection law

[10]Beijing explains what China's new data protection law really means – a month after it took effect

He summarizes the changes to a definition of espionage by emphasizing (with italics): "Attempts to illegally obtain or share state secrets, intelligence, or other data, materials, or items related to national security or national interests , which are carried out by or for foreign elements other than espionage organizations."

Again, Daum believes the changes don't represent expansions of power. "The scope of 'espionage' has already been so broad that it isn't immediately clear what the impact of the expanded definition will be" he wrote, adding that while the revised bill contains "a clear expansion of the scope of protected materials" it is "unworkably vague on its face."

But the previous law, he asserts, "was already so broad and unworkably vague, that it is not immediately clear what the expansion includes."

[11]

Daum is more concerned by amendments that address what he translates as "seeking to align with an espionage organization" – language he said "is troubling as it may justify penalizing more casual interactions with foreigners."

Another change adds a new definition of espionage as "Network attacks, intrusions, or disruptions targeting critical information infrastructure or entities involved with secrets." Daum argues that that insertion doesn't make more acts criminal, but does elaborate on obligations to report such conduct.

And as individuals committing acts of espionage can be detained for up to 15 days and deported or barred from China, that's of concern.

[12]

Yeah, OK. That email from your China office does now look a little risky – especially as Chinese law means local businesses can be fined for espionage. ®

Get our [13]Tech Resources



[1] https://www.theregister.com/2023/06/23/nate_fick_china_playbook_fightback/

[2] https://www.dni.gov/files/NCSC/documents/SafeguardingOurFuture/FINAL_NCSC_SOF_Bulletin_PRC_Laws.pdf

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZKKcQklE8pEjAHplsiChfAAAA5Y&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[4] https://www.chinalawtranslate.com/en/bad-as-it-ever-was-notes-on-the-espionage-law/

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZKKcQklE8pEjAHplsiChfAAAA5Y&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZKKcQklE8pEjAHplsiChfAAAA5Y&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[7] https://www.theregister.com/2023/02/27/china_data_regulatory_intervention/

[8] https://www.theregister.com/2022/07/08/cac_china_data_export_rules/

[9] https://www.theregister.com/2021/08/23/china_new_personal_data_protection_law/

[10] https://www.theregister.com/2021/10/01/china_data_protection_law_taxonomies/

[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZKKcQklE8pEjAHplsiChfAAAA5Y&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZKKcQklE8pEjAHplsiChfAAAA5Y&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[13] https://whitepapers.theregister.com/