THE RUNDOWN
China’s government expanded its anti-espionage law, a key piece of its national security legislation, to include cyberattacks for the purposes of intelligence collection and sensitive data theft. Though content in the current revision has not been made public, the preceding draft included language that those aiding foreign spies via “information, funds, supplies, labor, technology or shelter” would be warned or given administrative detention by state security authorities. The third draft of this amendment considers the broad nature of information networks as a conduit for cyber espionage, and includes intrusions, interference, control, and destruction under that umbrella. Potential penalties for anyone found in violation of the new amendment could face financial penalties as well as “detainment” by state security authorities, or some combination thereof.
China’s anti-espionage law first came into effect in 2014 and is largely regarded as an important tool to target perceived external foreign interference. The time of its enactment marked the transition of Xi-led China’s focus from economic development and growth to one that prioritized the need to address and preserve national security interests in a more comprehensive, and holistic manner. In 2017 and 2021, Beijing released more detailed implementation rules that provided better-defined terms and magnified some provisions to the law, underscoring a whole-of-country approach to countering foreign espionage. Also, in 2021, Beijing added a new regulation, empowering the government to identify companies and organizations that could be targeted by foreign infiltration, and mandate their implementation of appropriate security measures to mitigate the threat. Now, the recent inclusion of cyberattacks into this law can be viewed as a logical evolution that addresses the current state of espionage threats in an Internet-connected world, as well as the technologies that facilitate their operations.
The expansion comes on the heels of increased exposure of alleged U.S. cyber spying on Beijing, as well as the larger global community. Beijing has been in an intense influence campaign using media outlets and social media platforms to paint the United States as an egregious cyber actor intent on hegemony and spying on anyone it sees fit. Indeed, guiding public opinion is a strategy in which Beijing has been aggressively engaged, and one that President Xi stressed in 2016 emphasizing media’s role in adhering to its role in guiding public opinion. This continues a trend of Beijing proactively trying to shape external perceptions instead of just censoring news or flooding the information space with pro-China messages and themes.
While it uses these channels to chip away at the image and reputation of the United States, internally Beijing continues to refine its legal mechanisms as a way to increase the government’s ability to monitor the activities of its population, as well as those of any foreign presence to include commercial and business entities. The integration of the media and legal mechanisms is reflective of China’s “Three Warfares,” a strategy that employs media, legal, and psychological activities for the purpose of influencing specific audiences in favor of China or its interests. This can be exceptionally effective when they are integrated into a cohesive plan and is one which Beijing utilizes to counter narratives and anti-China sentiment.
The addition of cyber espionage to its Ani-Espionage Law supports Beijing’s legal pillar of its Three Warfares strategy by helping protect Chinese interests domestically by hamstringing an adversary’s spying activities, in this case, the United States. It also shows to the outside world that China acknowledges the threat of cyber espionage, which coincides with the myriad of articles written about U.S. cyber spying and cyber hegemony. The inclusion further codifies into law the very types of spy activities that it has been accused of doing – traditional and cyber espionage, use of academics as collectors, corporate and industrial espionage, land purchases, etc. – and turns attention back on the United States for its alleged involvement in these activities. Only instead of just being a case of “he said she said” finger pointing, Beijing overlays its media warfare efforts to reinforce the narrative of a distrustful United States and to build support for China’s technology, agricultural, trade, and diplomatic interests, to name a few.
But there’s two other components to the anti-cyber espionage provision that bear exploring. One, it clearly addresses Beijing’s concerns that internal dissidents could be enticed to cooperate with foreign interests in the facilitation of cyber espionage. In the third draft of the anti-cyber espionage provision, Beijing clarified the activities it associates with cyber espionage to include “spy organizations and their agents who implement or instruct, or fund others to implement, including domestic, foreign institutions, organizations, and individuals to carry out cyberattacks, intrusion, interference, control, sabotage and other activities against China’s state organs or units involved in classified or critical information infrastructure.” It’s evident that Beijing is sending a message to its populace not to help foreign intelligence lest risk financial penalties or incarceration.
A second component is that inclusion of the anti-cyber espionage provision into its existing Anti-Espionage Law provides Beijing the legal justification to indict foreign intelligence agents for breaking Chinese law. For several years, Beijing has denied and dismissed hacking allegations and not retaliating against U.S. indictments on its military and intelligence personnel suspected in such activities. With a more confident China becoming more aggressive in calling out alleged U.S. cyber malfeasance, Beijing is replicating what the United States has done with respect to China: use its own cybersecurity companies to expose cyber espionage campaigns against China, and now with the law, leverage the legal mechanisms in place to issue its own indictments, should it decide to pursue that course of action.
Chinese media has said that the new anti-espionage provision will ultimately improve the business environment in China because it improves regulations on spying, defines cyber espionage practices, and enhances security by filling in loopholes. Statistics in the first couple of months of 2023 shows an increase in foreign direct investment (FDI), countering claims made by those like Japan’s media that the provision will undermine China’s business climate, putting foreigners at greater risk. Beijing has responded with its typical response that as long as companies abide by Chinese law, they would have no issues. Whether a fair statement or not, FDI continues to outweigh concerns for some states. Among the first quarter of 2023, FDI increased from notable U.S. allies France, Germany, and the United Kingdom, who have been victims of Chinese cyber spying.
Tensions between China and the United States are at an all-time high, a disconcerting turn of events for the world’s two largest economies. After years of being the global cyber villain, Beijing will no longer be complacent to endure barbs for the sake of other interests. The anti-espionage provision dovetails nicely with its recent campaign against United States alleged cyber infractions and hegemonistic practices. It’s trying to give Washington a black eye, though the impact remains to be seen.
Nevertheless, Beijing is stepping up, seeing its opportunity to gain ground globally while the United States is neck-deep in Ukraine and embroiled in its own internal political squabbles. The state of their relations will likely dictate if and when Beijing exercises the anti-cyber espionage provision against the United States and any actors it identifies.
Like any international indictment, there will be no arrests or extradition. However, Beijing will have tossed Washington into the basket of hostile state actors from China, Iran, North Korea, and Russia that have officially received similar charges, an inauspicious place to be for the world’s foremost democracy. It may also require Beijing to show its work to substantiate its claims, something that states have generally shied away from sharing with the public, though if it did, would set the bar higher the next time a government calls out China’s or any other government’s cyber nefariousness.
THE TAKEAWAY
Heightened concerns of how this new provision will affect foreign firm presence in China miss the bigger the picture of how Beijing is steadily trying to replace the United States as global influencer. What’s more, it’s using the tactics the West has used against China for so many years when castigating China’s cyber malfeasance: it’s publicizing Chinese vendor reports and using media to broadcast suspicious cyber incidents and linking them to the United States. In this manner, the anti-cyber espionage provision gives Beijing more than justification to target foreign firms or dissidents. It gives it the legal means to publicly take the fight back to Washington.