ARCHIVED: Commentary No. 89: China and the Internet

September 2006
Unclassified

Commentary No. 89 has been archived.

Editors Note:

The publication of Commentary is intended to provide a platform for public discourse on issues related to national security.

Disclaimer: Publication of an article in the Commentary series does not imply CSIS authentication of the information nor CSIS endorsement of the author's views.

---

Introduction

The Internet continues to expand rapidly in China, which already has over one hundred million users and will soon become the country with the greatest number of citizens on-line.  While a decade ago it was widely argued that the spread of the Internet would inevitably lead to a more open and democratic China, the subsequent reality has proven more complicated.  The Chinese state has sought with considerable success to balance the economic benefits of the Internet against concerns about maintaining and even enhancing authoritarian political control, and pursuing China's perceived national interest.  Consequently, the use of the Internet in China raises a host of interrelated issues, several of direct significance to Canada.

Government Regulation of the Internet

In its efforts to regulate the Internet, the Chinese government must deal not only with the spread of the Internet, but also with its changing technology.  A cycle of technological innovation and regime adaptation has developed over the last decade. State methods of control range from low-tech approaches such as imprisoning dissidents posting material on the Internet and physical surveillance of computer monitors in Internet cafés, to more high-tech approaches such as electronic monitoring and filtering. One useful way to think of state regulation of the Internet is in terms of three broad approaches: legal regulation, encouragement of self-regulation and monitoring, and technological regulation.

Since 1994, the Chinese government has issued over sixty sets of regulations governing the use of the Internet.  These have grown steadily more comprehensive over time. Overall responsibility for the supervision of the Internet belongs to the Ministry of Public Security (MPS), but at least a dozen other entities also have some authority over access and content.^[1] The regulations encompass complex licensing requirements for Internet providers, registration of  individual users, and broad restrictions on permissible content.  The regulatory regime is both extremely detailed and at the same time extremely vague.  For example, it is forbidden to post material on "topics that damage the reputation of the State," but there is no way for a user to know whether a given topic meets this criterion.  This gives the police apparatus wide leeway in legally prosecuting Internet users under the Chinese criminal code.  As of 2004, Amnesty International reported that there were known to be at least fifty political dissidents currently incarcerated for posting political opinions or material on the Internet ^[2] .  The latest regulations, promulgated in September 2005 by the Information Office of the State Council and the Ministry of Information Industry, set limits on the entities legally permitted to disseminate news, and punishments for those disseminating "false or distorted" information. Since the regulations seem to cover not only news agencies and other content providers as such, but also message boards (BBS) and potentially blogs, they make all manner of content distributed using these new technologies possibly illegal.^[3]

The vagueness about what constitutes information and the legal constraints on information are partly responsible for another broad trend in the development of the regulatory regime, namely the downloading of responsibility for regulation to content providers and Internet service providers (ISPs). This responsibility is explicitly assigned in the State Council's Order No. 292 of 2000, "Measures on Internet Information Services." These outline the general categories of prohibited materials and require that if such material is discovered, the ISP must record and retain relevant information and report the situation to the authorities. Essentially, this is an attempt to use regulations to shape the Internet market by persuading its participants to exercise defensive self-censorship. In 2003, the government issued a "Public Pledge for Self Discipline for China's Internet Industry."  Under government pressure for "voluntary" compliance, over 300 companies, including the large Sina.com and Sohu.com, and Yahoo's China division, have agreed to the pledge, which commits to "strict restrictions on the freedom of expression of users."^[4]  Further down the hierarchy, the pledge and other regulations have led ISPs and cyber­cafés to implement a range of monitoring and surveillance systems.

While the legal regime and efforts to promote self-censorship constitute worrisome constraints on freedom of expression in China, the most striking dimension of China's regulation of the Internet is the so-called Great Firewall, an array of technologies that filter and monitor Chinese people's access to the Internet. The Chinese authorities have imposed a system of multiple overlapping controls at access points, at intermediaries such as ISPs, and on the national backbone network. The technical capacity of the system includes blocking domestic and overseas Web sites, filtering content and key words on Web pages, monitoring and suppressing e-mail and surfing; phone and SMS message tracking, hijacking PCs and sending out viruses.  Estimates of total expenditure on the system run as high as US $800 million.  The Internet control system also interlocks with the Golden Shield, a national infrastructure project aimed at "the adoption of advanced information and communication technology to strengthen central police control, responsiveness, and crime combating capacity, so as to improve the efficiency and effectiveness of police work."^[5]

An exhaustive recent study by the OpenNet initiative demonstrates that while some experienced Internet users are able to circumvent the restrictions, the regulatory system unquestionably serves to limit the free flow of information.^[6]  Furthermore, it subjects those who use the Internet to the possibility of criminal prosecution. In recent testimony to the U.S.-China Economic and Security Review Commission, John Palfrey of the Berkman Center for Internet & Society at Harvard Law School stated that, "By any means of comparison, the People's Republic of China's  Internet filtering regime has the greatest effect on the freedom of expression of any filtering regime throughout the world."^[7]

It is difficult to gain a full understanding of opinion within China on the question of Internet censorship. While political dissidents outside of China complain about it vigorously, some Chinese bloggers have also pointed out that the idea that Internet censorship constitutes a particular problem is shaped by the assumption that the Internet must be free.  In fact, many Chinese Internet users may not notice the limits on freedom of expression on the Internet, since these limits are precisely the same as the limits placed on their freedom of expression in other aspects of their lives.  According to this line of argument, the Chinese state's restrictions on the Internet are no more or less legitimate than its restrictions on any other type of activity.

For the most part, the Chinese government's regulation of the Internet is a human-rights rather than a security issue. While it is true that opponents of the Beijing regime have used the Internet as a forum for dissent, the common arguments that the spread of the Internet will inevitably promote freedom of speech and democratization are not completely convincing. On the contrary, in some ways the Internet actually strengthens the capacities of the Chinese government for authoritarianism and repression. China's success at containing the political consequences of the Internet may serve as a model for other authoritarian states.

Foreign companies are implicated in these human-rights challenges in a number of ways. Several recent cases have seen foreign companies compromise their position on freedom of expression in response to pressure from or concern about angering the Chinese government. For example, Microsoft's Chinese Internet portal bans words such as "democracy" and "freedom" from parts of its Web site.^[8]  More recently, Microsoft also shut down the blog of popular political journalist Zhao Jing, who writes under the name Michael Anti. ^[9] In the most worrisome of the recent cases, Yahoo provided monitoring records that led to the sentencing of journalist Shi Tao to ten years in prison for disseminating state secrets.  Shi had sent an e-mail containing a document from the Chinese Communist Party's (CCP) propaganda office forbidding media coverage of the anniversary of the Tiananmen massacre. Yahoo's records were handed over to police, which enabled them to track down and prosecute Shi.^[10] 

Chinese regulation of the Internet is not always purely a human-rights issue, for China's interconnection with the rest of the world means that suppression of information can at times lead to damaging consequences that extend beyond China itself.  The clearest example of this was the SARS outbreak of 2003. Most analysis concurs that from February to April 2003, the Chinese government sought to cover up the seriousness of the SARS epidemic. Both traditional media and the Internet were monitored and censored.^[11]  During that time, the disease spread widely throughout China, and later to the rest of the world, with particularly serious consequences for Canada. Though the government position eventually changed to recognizing the problem, there was never any admission that censoring Internet had contributed to the problem. On the contrary, in May 2003, the official Chinese News Agency, Xinhua, reported that over 100 people had been arrested for "spreading rumours" or "false information" through the Internet or SMS about SARS.^[12]   It remains to be seen whether the government will maintain a similar posture during a future outbreak of epidemic disease such as avian flu.

A second area in which censorship of the Internet could directly affect Canadian interests is in reporting financial information.  Canadian individuals and entities are increasingly involved in Chinese capital and other markets, and therefore rely increasingly on access to accurate financial information.  Various kinds of relevant information that affect the accurate valuation of Chinese companies, such as bank non-performing loans and investigations into corruption, have been subject to official censorship in Chinese media, including Internet media.  Besides distorting the supply of information in the marketplace and harming the interests of those without access to relevant information, censorship of financial information also hinders the further development of the market.  The flip side of this issue is that the Internet can also be used to spread disinformation.  The Chinese newsmagazine CAIJING has reported on a number of cases of publicly listed Chinese firms releasing false information in order to inflate share price.

The Chinese Government's Use of the Internet

The Chinese government, as well as the CCP, use the Internet to disseminate propaganda favourable to them.  A speech by then General-Secretary Jiang Zemin in 2001 outlined the importance that the leadership attaches to the Internet.  Jiang stated, "We should attach due importance to opinion-making and publicity by using the Internet.  In general principle we should actively develop the Internet, make full use of it, tighten up its management, maximize what is good and minimize what is bad, tap our strengths, take the initiative in our hands, constantly increase the influence and combat­ effectiveness of our Internet publicity work, and turn it into a new sector in the ideological and political work of the Party and state, and a new channel for our foreign publicity work."^[13]

Xiao Qiang, Director of The China Internet Project at the Graduate School of Journalism, University of California at Berkeley, estimates that 10% of all Chinese content on the Internet is government-produced. ^[14]  This propaganda is linked to the filtering mechanisms described above, because they allow searches to be filtered or surfers redirected to reach only content that is acceptable to the Chinese government, beginning with its own propaganda.

Propaganda does not in and of itself constitute interference, but other elements of the Chinese government's use of the Internet do. Chinese entities clearly possess capacities for cyber-attacks and hacking of foreign networks. Such attacks often rise in tandem with other international events.  Examples include attacks on US networks in the aftermath of the 1999 bombing of the Chinese embassy in Belgrade and the 2001 EP3 spy-plane incident; on Taiwanese networks in 1999 after the Taiwanese President called for a redefinition of Taiwan-China relations, and in 2000 during the inauguration of pro­independence President Chen Shuibian; and on Japanese networks during the recent upturn of anti-Japanese nationalism in China. Such attacks involve Web site defacements, denial of service attacks and virus writing, and are matched by similar campaigns by American and Taiwanese hackers. ^[15]  It is generally impossible to assign culpability to the Chinese government for such attacks. 

One significant exception was the attacks on U.S., U.K, and Canadian servers hosting Falungong materials in 1999-2000. After tacitly permitting, and some would argue even supporting, Falungong, in the summer of 1999, the CCP leadership declared it an evil cult and began a campaign of suppression against its adherents.  In July 2000, several Falungong sites became the target of denial of service attacks, in which the target server is flooded with requests for data until it crashes. Research by RAND revealed that the source address of the attack was an organization called the Information Service Centre of XinAn Beijing.  The Centre turned out to be located within the main offices of the Ministry of Public Security (MPS).   When this information was revealed in world media, the address of the Centre was immediately changed, suggesting that the MPS was not simply the victim of a disinformation campaign by some third party.  Of course, it remains unclear whether the attack was officially authorized by the Chinese leadership or was rather the work of independent or even rogue elements within the MPS.  One interesting twist to the attacks is that they seem to have been designed to make it appear as if Falungong was conducting its own information operations against the Web site of the U.S.  Department of Transportation. The RAND report speculates that this may have been a deliberate plan to bring down the Falungong site at the same time as spreading the impression that Falungong itself was a terrorist organization.^[16]

The same RAND report also includes details on several other forms of harassment by Chinese entities using the Internet. These include sending phony e-mails purporting to come from non-Chinese adherents of Falungong, including Canadians, and bombarding mailboxes of known Falungong adherents with spam, in order to effectively deny them access to the Internet.  Such interference, while disturbing in and of itself, provides further evidence of Chinese capabilities, if not intentions, to use the Internet.

The Internet is also widely used by Chinese entities for intelligence-gathering. The best documented incident, code-named Titan Rain, involved a coordinated group of hackers based in China who gathered documents from U.S. army institutions such as the Redstone Arsenal in Alabama; Information Systems Engineering Command; the Defense Information Systems Agency; the Naval Ocean System Center and the Space and Missile Defense Acquisition Center. Stolen files were hidden in computers in South Korea before being sent on to Guangdong, China. In a more recent case, in 2005, e-mails believed to have originated in China were sent to addresses at the UK parliament. These e-mails, tailored to the individual recipients, contained spyware that searched the recipient's computer for potentially valuable documents which were then covertly sent back to the e-mail originator without the user's knowledge. The technological sophistication of the attacks, the nature of information targeted—including U.K. policy on human rights in China, an issue likely to be of little interest to economically motivated hackers, and the fact that hacking in China is an offense that potentially carries the death penalty, all led investigators to believe that these attacks were carried out with government authorization.^[17]

Not all Chinese intelligence gathering using the Internet is political and military in nature.  Extensive evidence also shows Chinese entities using the Internet for economic espionage, as well as science and technology intelligence gathering. For example, in 2004 corporate security firms in the US discovered that a Trojan horse, or program used to steal files from infected computers, called Myfip, which was attached to e-mails sent from servers in China, was used to locate and transmit files including mechanical designs and circuit board layouts back to China.  An earlier version of the program searched for PDF files only, but subsequent versions broadened the search to Word and CAD/CAM documents.^[18]  In these cases,  it is generally impossible to determine whether specific intelligence-gathering efforts are authorized or sanctioned by the Chinese government, or indeed whether the intelligence-gathering attacks are launched from a third location via China.

Information Warfare

A final dimension of China's use of the Internet that bears discussing is the question of information warfare. This section will not provide a comprehensive overview of Chinese doctrine and capabilities for information or cyber-warfare, but only a brief summary of how these relate to the Internet. Information warfare has been identified as a crucial part of China's military modernization. Current doctrine stresses asymmetric warfare, which in the Chinese context generally refers to the use of unorthodox methods to defeat a numerically or technologically stronger opponent. Cyber- warfare is described in Chinese military writings as a cost-effective method of asymmetric warfare, in that it can exact significant damage at minimal cost. In their influential work Unrestricted Warfare, published by a PLA publisher in 1999, PLA officers Qiao Liang and Wang Xiangsui mention an attack scenario combining a financial attack, an Internet attack and a military one. "If the attacking side secretly musters large amounts of capital without the enemy nation being aware of this at all and launches a sneak attack against its financial markets, then after causing a financial crisis, buries a computer virus and hacker detachment in the opponent's computer system in advance, while at the same time carrying out a network attack against the enemy so that the civilian electricity network, traffic dispatching network, financial transaction network, telephone communications network, and mass media network are completely paralyzed, this will cause the enemy nation to fall into social panic, street riots, and a political crisis".^[19]   While the authors themselves do not appear to have any operational authority, the publication of these ideas at the very least indicates that the Chinese military is discussing and planning for the development of such capabilities.  This view is borne out by research that shows that the PLA is engaged in doctrinal development as well as simulation and exercises along those lines.^[20]

Summary and implications for Canada

China's use and regulation of the Internet raise a wide range of important issues for Canada, from human rights to security.  Canadian government agencies, companies and individuals should be aware of these issues in making their decisions. The Chinese government will continue to pursue policies that maximize the benefits and minimize the negative costs associated with the Internet as they perceive them. A cycle of technological development and state adaptation will continue. Thus, filtering, monitoring and other restrictions on freedom of expression will probably persist. Such steps, intended chiefly to minimize threats to the continued political control of the CCP, generally do not affect  Canadian security directly. However, when the information suppressed involves such subjects as health or financial activities, Canadian interests may be damaged. The Chinese government is also likely to continue its efforts to develop cyber-warfare capabilities using the Internet, and to maintain or further develop its capabilities to conduct interference in foreign countries, including Canada, through hacking, harassment, and intelligence gathering.

---

Open Net Initiative, "Internet Filtering in China in 2004-2005: A Country Study".

http://www.opennetinitiative.net/studies/china/ONI.China Country Study.pdf,   appendix 2.

http://web.amnesty.org/library/Index/ENGASA170012004

http://www.chinalawandpractice.com/default.asp?Page=1&SID=4869

Susan W. O'Sullivan, Testimony at US-China Economic and Security Review Commission, April 14 2005.

http://www.ichrdd.ca/english/commdoc/publications/globalization/goldenShieldEng,html.

OpenNet Initiative, "Internet Filtering in China in 2004-2005: A Country Study,"

http://www.opennetinitiative.net/studies/china/ONI China Country Study.pdf.

http://www.uscc.gov/hearings/2005hearings/written testimonies/05 04 14wrts/palfrey john wrts.htm.

Mure Dickie, "Don't Mention Democracy, Microsoft Tells China Web Users," Financial Times, 13/06/2005.

http://rconversation.blogs.com/rconversation/2006/01 microsoft_ takes.html.

Tina Rosenberg, "Building the Great Firewall of China, with Foreign Help," New York Times, 18/09/2005.

http://www.uscc.gov/hearings/2003hearings/written_testimonies/03_06_05/qiates.htm

http://www.freemedia.at/wpfr/Asia/china.htm.

Speech at the National Conference of Directors of Publicity Departments, 10/01/2001,
http://english.pladaily.com.cn/special/three/content/10.htm

http://english.epochtimes.com/news/5-10-22/33610.html

http://www.infowar-monitor.net/modules.php?op=modload&name=Archive&file=index&reg=listarticles&secid=4

http://www.rand.org/pubs/monograph reports/MR1543/index.html.p74

Peter Warren, "Smash and Grab, the hi-tech way", Guardian, 19/01/2006.

Nathan Vardi, "Chinese Take Out," Forbes, 25/07/2005; Robert Lemos, "Targeted Trojan-Horse Attacks Hitting US, Worldwide," Security Focus, 24/06/2005.

http://www.c4i.org/unrestricted.pdf. P145.

Thomas Timothy L., "Like Adding Wings to the Tiger: Chinese Information War Theory and Practice@ (Foreign Military Studies Office: Fort Leavenworth, KS. 2001); "China: Troops Beijing Trained For Electronic Warfare" (Zhongguo Tongxum She News Agency : Hong Kong, August 9,1999).

---

Commentary is a regular publication of the Analysis and Production Branch of CSIS. Inquires regarding submissions may be made to the Chairman of the Editorial Board at the following address:

The views expressed herein are those of the author, who may be contacted by writing to:

CSIS
P.O.Box 9732
Postal Station T
Ottawa, Ontario K1G 4G4
Fax: 613-842-1312

ISSN 1192-277X
Catalogue JS73-1/89