China’s legislature approved its Cybersecurity Law this past November, solidifying China’s regulatory regime for cyberspace and potentially disrupting foreign companies that use or provide telecommunications networks in China. The law takes effect June 1, 2017, and reflects China’s desire for “cyber-sovereignty” (regulating the Internet in China according to national laws, despite the global nature of the World Wide Web). As the Chinese Communist Party (CCP) faces pressure from slowing economic growth and foreign influence, the Cybersecurity Law is one in a series of laws the Chinese government has implemented recently to uphold state security.
Significant Provisions of the Law
Though the wording of the law is vague, it formalizes many current practices and aims to consolidate cybersecurity authority under the Cybersecurity Administration of China. While the government is expected to offer more clarification on the law through implementation rules, how the law is played out in practice will be the ultimate indicator of the law’s severity. These three aspects of the law have the greatest potential to affect multinational companies (MNCs) doing business in China, according to an NACD analysis:
1. Data localization: Article 37 of the law is one of the most contentious and requires that “critical information infrastructure” (CII) operators store personal information and other important data they gather or generate in mainland China to be storedin mainland China. CII operators must have government approval to transfer this data outside the mainland if it’s “truly necessary.” The definition of CII is a catch-all, including public communication and information services, power, traffic, water, finance, public service, electronic governance, in addition to any CII that would impact national security if data were compromised.
Impact: The broad applicability of the CII definition raises the concern that any company using a telecommunications network to operate or provide services in China would be required to store data in mainland China, possibly even affecting those that store data to clouds with servers located outside mainland China.
2. Support for Chinese security authorities: Article 28 requires “network operators” to provide technical support to security authorities for the purposes of upholding national security and conducting criminal investigations. Network operators are broadly defined as those that own or administer computer information networks or are network service providers, which may include anyone operating a business over the Internet or networks.
Impact: The loose definition of “technical support” creates the concern that MNCs will be required to grant Chinese authorities access to confidential information, compromising private information and intellectual property that may be shared with state-owned competitors. Although not stated in the final version of the law, there is also the possibility that companies may be required to provide decryption assistance and backdoor access to authorities upon request.
3. Certified network equipment and products: For network operators, Article 23 indicates that “critical network equipment” and “specialized network security products” must meet national standards and pass inspection before they can be sold or supplied in China. A catalogue providing more specification on these types of products will be released by the government administrations handling cybersecurity. Under Article 35, CII operators are also required to undergo a “national security review” when purchasing network equipment or services that may affect national security.
Impact: Chinese companies and government agencies have historically relied on computer hardware and software manufactured by foreign companies, although this is now shifting in favor of domestic IT products. Opportunities for hacking and espionage put China at risk of losing sensitive information to foreign governments or companies, and China has already started conducting reviews of the IT security products used by the central levels of government. This provision of the Cybersecurity Law demonstrates China’s resolve to mitigate this risk and may pose a significant barrier to foreign IT equipment manufacturers selling products in China.
How Directors Can Prepare
China’s Cybersecurity Law has been criticized by the foreign business community, and, depending on the law’s implementation, it may make doing business in China for MNCs not only more complex but also riskier. Tom Manning, a China specialist at the University of Chicago Law School and director of Dun & Bradstreet, CommScope, and Clear Media Limited, advises boards to consider the effect of the Cybersecurity Law in the greater context of China’s rise: “The Chinese economy is increasingly more self-sufficient. Domestic companies are growing stronger and are more capable, while multinational companies are finding it more difficult to compete.”
Manning suggests boards conduct an overall China risk assessment, with the Cybersecurity Law as the focal point. While some companies may determine the risk of doing business in China is too high, Manning says, others might decide they need to invest more in China to be profitable. Ultimately, creating alliances with domestic firms, who have a greater influence over the government’s implementation of the law, may be key. “Leading domestic companies have a stake in seeing a better definition of the law, and their interests aren’t unaligned with multinational companies,” Manning says. “Chinese Internet companies can explain to the government how the law will affect their business models and be more effective in doing so than Western companies.”
Although how the law will be enforced remains to be seen, boards can consider the following questions when evaluating the impact of China’s Cybersecurity Law:
Are we storing information generated or gathered in mainland China on servers in mainland China? Do we need to create separate IT systems for China-specific data? Are we reliant on cross-border data transfers, and how would we approach this need with the Chinese government?
What is our risk exposure stemming from the potential loss of intellectual property or encryption information as a result of this law? How would our business be affected should our Chinese competitors gain access to this information?
For computer hardware or software manufactures, are we willing to share our source code with the Chinese government?
For technology firms, how does the law alter the playing field for our company to compete in China against domestic firms?
What additional investments do we need to make in order to comply with this law?
The second plenary session this morning addressed an issue that has pervaded nearly every other presentation about doing business at home and abroad. The session, “Doing Business in China,” included three people very familiar with the U.S.-China relationship and they provided some guidance on what an American company may expect when doing business abroad.
Ambassador J. Stapleton Roy, former ambassador to China and head of the Kissinger Institute on China at the Woodrow Wilson Center, began the session with an overview about the “fastest growing economy in the world.” Roy said that China was transitioning in a positive direction, but stressed that the government was still an active player in business relationships there. Due to that active relationship, U.S. government policy and engagement with its Chinese counterparts can have significant effects on a company’s business prospects. Barbara Hackman Franklin, former U.S. Secretary of Commerce, added that the “relationship between the two governments sets a tone for doing business.”
The conversation also touched on several difficulties companies face while doing business in China. John Frisbie, president of the U.S.-China Business Council, offered a list of problems that companies may face, including inadequate enforcement of intellectual property rights; finding and maintaining top talent; and government preference for Chinese companies. On the subject of intellectual property rights, the panelists said that while no company is currently immune from the weak enforcement of rights, especially software and movie companies, the situation is gradually improving. Roy pointed out that China wants to increase their own intellectual property creation and government officials understand that better protection and enforcement is essential to this.
The panelists left the audience with an understanding that the Chinese market has huge potential but there are many complex aspects that must be thoroughly considered and explored before doing business there.
NACD held its third annual Cyber Summit in Chicago on June 21, 2017, in partnership with the Internet Security Alliance (ISA). This year’s event followed in the wake of cyber incidents such as WannaCry and the hacking of the Democratic National Committee’s email account, as well as Europe’s adoption of the General Data Protection Regulation (GDPR) and the implementation of China’s Cybersecurity Law.
NACD members left the Cyber Summit with valuable lessons to share with their colleagues.
Speakers acknowledged this context and focused on topics such as building a cyber-risk culture, insider threats, cyber-risk regulation, the threat of state-sponsored attacks, and the economics of cybersecurity. (Click here for a list of event sessions and speakers.)
Five key takeaways emerged for director attendees at the 2017 NACD Cyber Summit:
1. Actively learn from cyber incidents at other companies. A bill that aims to require cyber expertise on public company boards has surfaced twice in Congress since 2015. However, Melissa Hathaway—president at Hathaway Global Strategies and senior advisor at Harvard Kennedy School’s Belfer Center for Science and International Affairs—believes boards do not necessarily need to have a director who is an expert in cybersecurity. Hathaway, who delivered a keynote at the cyber summit, suggests boards regularly hold conversations about current events in cybersecurity, and review a cyber-event case study at each quarterly meeting.
2. Work toward a public-private partnership. Hathaway emphasized the benefit of forming a public-private partnership in the United States to serve as a medium for information sharing about cyberattacks. Canadians have already formed such an organization. The Canadian Cyber Threat Exchange is an independent nonprofit that functions as a middleman between the public and private sectors. According to Hathaway, the U.S. government itself has been a victim of a number of cyberattacks exposing personal data, which has cost it credibility with the private sector. Thus far, U.S. corporations have been largely reluctant to share information about cyberattacks with a government that may not be seen as equipped to adequately respond. At the same time, the government classifies data on cyberattacks that limits information sharing with the private sector.
3. Consider having the CISO report directly to the board. The 2016–2017 NACD Public Company Governance Survey indicates that only 31 percent of boards receive reports directly from the chief information security officer (CISO), despite the increased prevalence and importance of the role. Bret Arsenault, corporate vice president and CISO at Microsoft, indicated that the frequency of meetings between the CISO and the board depends on the board’s existing cyber knowledge. As Microsoft’s CISO, Arsenault conducts a quarterly review with both the full board and the audit committee, in addition to meeting with the CEO and the full leadership team for a half hour once each week. Having all members of senior management involved in the conversation helps set the tone at the top around cyber culture. See the 2017 Cyber-Risk Oversight Handbook for guidance on building a relationship with the CISO (p. 38) and questions for the board to ask management about cybersecurity (p. 21).
4. Strengthen a culture of secure behaviors. In providing oversight of cybersecurity, one aspect of the board’s role is to ensure that the organizational culture reinforces healthy cybersecurity behaviors. For this culture to take hold, it is essential that any cybersecurity-related issues be explained to the board—and employees—in a clear, understandable way. For example, the CISO should speak in business terms to the board and avoid using technical language, according to Arsenault. John Lhota, managing principal for global cybersecurity consulting services at SecureWorks, also suggested using gamification for employee cyber education programs. Directors should evaluate whether a culture of awareness about the importance of cybersecurity truly exists, beginning at the board level. See NACD’s Cyber-Risk Oversight Handbook for tools on assessing the board’s cybersecurity culture (p. 27) and establishing board-level cybersecurity metrics (p. 28).
5. Ensure access rights are limited and continuously monitored. Directors should discuss with management what the company’s most critical data assets—or, “crown jewels”—are, and who could access them. Many high-profile breaches have been carried out by employees or contractors with access to company networks. Robert Clyde, vice chair of ISACA and managing director for Clyde Consulting LLC, indicated the hiring process can aid in selecting trustworthy employees, but employees with administrative privileges (i.e., the ability to install certain software, access certain files, or change configuration settings) can become very destructive if they retaliate against the company after a job loss or make a mistake. The board should check with the CISO to make sure there are a very small number of employees that have administrative privileges on an everyday basis, with slightly more given access in an emergency. Adding secondary approvals—so that two people must be involved in a process—further constrains the possibility of someone accidentally deleting data or removing it on purpose. Access for those with administrative privileges should be amended the second those individuals change jobs, according to Robert Zandoli, director of the ISA and global chief information security officer at BUNGE Ltd.
For more information on providing cybersecurity oversight, please see the following NACD resources: