China makes legitimate move with cyber policy

China’s new cyber space vetting policy targeted at IT products and services, which was announced on Thursday, is a belated move rightly taken by China, one of the world’s largest victims of cyber-theft.

Major IT products and services will be subject to government cyber security vetting if they concern national security and public interest, according to the State Internet Information Office.

The vetting is aimed to prevent a supplier from taking advantage of its products and services to illegally control, disturb or shut down the computer systems of its clients, as well as gather, store, process or use its clients’ information, according to an office statement.

China has become one of the largest victims of global cyber-theft. In 2011, it suffered from cyber attacks from 47,000 foreign IP addresses, most of them from the US and its allies, according to National Computer Network Emergency Response Technical Team Coordination Center (CNCERT). The situation has failed to improve since then, making it highly necessary for China to take countermeasures to protect its Internet security.

A large number of those attacks on China have targeted the country’s big companies, such as Huawei, and government departments and agencies, meaning China’s national security and business interest are at stake.

It is, therefore, legitimate for China to learn from leading Internet powers to devise its own Internet equipment and service vetting standards to protect national interest.

In 2012, the US House Permanent Select Committee on Intelligence conducted security investigations on Chinese IT firms. And it also asked federal agencies to choose cloud computing services from service providers that passed its security vetting.

In the UK, companies have to be vetted to meet new cyber security standards if they want to do business with the government, according to a new government policy from 2013. The policy prepares UK businesses against the growing threat of online attacks.

For China, Internet attacks could be a fatal threat given its weak technological abilities and lack of high-caliber professionals in related fields. It depends heavily on imports of key computer components, such as CPUs, operating systems, databases and high-end server products, making it highly vulnerable to online threats. Its IT markets, meanwhile, have been dominated by Western giants, such as Microsoft, Cisco, IBM, and Intel.

Now the number of Internet users in China has risen to 618 million, the largest number in the world. But China’s poor technological capacities have prevented the country from effectively protecting its users.

The Snowden incident served as a catalyst for China to accelerate its cyber security build-up. It has become more alert following the revelations of Edward Snowden, a former US National Security Agency (NSA) contractor that the US had been spying on various Chinese institutions and companies.

The new IT product and service vetting policy could be the start of China’s renewed efforts to build its own “technological Great Wall” to protect its national interest. It set up a central Internet security and information-leading group led by President Xi Jinping in February.

More steps could follow suit as President Xi vowed to turn the nation into an “Internet power.”