Report concerning the Inspection of the Implementation of the “Cybersecurity Law of the People’s Republic of China” and the “National People’s Congress Standing Committee Decisions concerning strengthening Online Information Protection”
Presented at the 31st Meeting of the 12th National People’s Congress Standing Committee on 24 December 2017
Cybersecurity affects the long-term governance of the Party, affects a long period of peace and order for the country, and affects economic and social development as well as the personal interests of the popular masses. General Secretary Xi Jinping has emphatically pointed out that without cybersecurity, there is no national security, without informatization, there is no modernization. The National People’s Congress attaches high importance to cybersecurity work, deliberated and passed the “National People’s Congress Standing Committee Decision concerning Strengthening Network and Information Security Protection” in December 2012, and deliberated and passed the “Cybersecurity Law of the People’s Republic of China” in November 2016 (hereafter referred to as the “Law and Decision”). On the basis of the 2017 supervisory work plan, the National People’s Congress Standing Committee Law Enforcement Inspection Group has conducted a review of the implementation situation of the “Law and Decision” from August to October 2017. Now, on behalf of the Law Enforcement Inspection Group, I report to the Standing Committee.
I, The work situation of law enforcement inspection.
The Cybersecurity Law took effect on 1 June of this year. Opening a law enforcement inspection of a newly formulated law, having effect for less than three months, is a first in the NPCSC’s supervision work. Committee chair Zhang Dejiang attached full importance to this law enforcement inspection, and provided important instructions, pointing out that cybersecurity affects the country’s long term peace and order, and affects economic and social development as well as the well-being of the popular masses. The NPCSC launching law enforcement inspection in the same year that the Cybersecurity Law has taken effect, is an implementation of the spirit of the important instructions of General Secretary Xi Jinping concerning “we must establish a correct cybersecurity view”, to supervise relevant parties to further strengthen legal propaganda, strengthen the cybersecurity awareness of all of society, grasp the formulation of accompanying laws and policies, ensure the effective implementation of the law, strive to upgrade cyberspace governance levels and realistically safeguarding security in national cyberspace and the lawful rights and interests of the people. We hope that the inspection group have meticulously organized this law enforcement inspection, persisted in problem-based guidance, and found through in facts. On the basis of the spirit of the instructions of Committee chair Zhang Dejiang, the Internal Judicial Committee, Finance and Economics Committee, Education, Science, Culture and Health Committee and the Standing Committee Office researched the matter repeatedly, and established the five focus points of this law enforcement inspection: the first is the situation of conducting legal propaganda and education work; the second is the situation of formulating accompanying regulations and rules; the third is the situation of strengthening critical information infrastructure protection and implementing the multi-level protection system for cybersecurity; the fourth is the situation of bringing online unlawful information under control and safeguarding the benign ecology of cyberspace; and the fifth is the implementation of the citizens’ personal information protection system, and investigating and prosecution unlawful and criminal acts violating citizens’ personal information and related matters.
On 25 August, the Law Enforcement Inspection Group convened its first plenary meeting to convey the important instructions of Committee chair Zhang Dejiang. The meeting heard the reports of the Cyberspace Administration of China, the Ministry of Industry and Information Technology, the Ministry of Public Security, the State Administration of Press, Publications, Radio, Film and Television and the Supreme People’s Court concerning the implementation situation of the “Law and Decision”, the Ministry of Education, the Ministry of Science and Technology and the Ministry of Traffic and Transportation submitted written reporting materials.
On the basis of arrangements, deputy Committee chair and Chef Secretary Wang Zhen, Deputy Committee Chairs Shen Yueyue, Zhang Ping, Wan Exiang, Chen Zhu and myself participated in this law enforcement inspection. The Inspection Group visited six provinces (regions, municipalities) Inner Mongolia, Heilongjiang, Fujian, Henan, Guangdong and Chongqing to conduct investigation, in that period, the Inspection Group heard reports from relevant provincial, municipal and county governments, successively convening over 30 discussion meetings, and inspected several cybersecurity command platforms and critical infrastructure operating work units on the ground. Furthermore, it also entrusted 12 provincial (regional, municipal) People’s Congresses to conduct an investigation of the implementation situation of the “Law and Decision within their administrative area.
In order to deeply understand the implementation situation of the “Law and Decision”, this law enforcement inspection conducted several new trials in terms of methods and approaches: first, it invited third-party expert bodies to participate. From early September until mid-October, the Inspection Group selected 20 important information systems in each of the six provinces (regions, municipalities) for on-the-ground inspection, and entrusted the China Information Security Monitoring Centre with conducting a vulnerability sweep and a mock attack, and issued a specialized monitoring report on the basis of the situation of monitored systems’ cybersecurity. The Inspection Group also entrusted the China Youth Daily Social Survey Centre with conducting popular opinion surveys in 31 provinces (regions, municipalities) on the basis of questions in 10 areas of the “Law and Decision” that closely affect the public, and they issued a survey report. In total, 10370 people participated in this survey. The orderly participation of third-party bodies strengthened the expertise, authority, objectivity and fairness of this inspection. Second, expert participation. Considering the strong specialized nature of cybersecurity, during the law enforcement inspection period, the Inspection Group successively invited 21 cybersecurity experts and technical personnel having engaged in cybersecurity work for a long time from the State Information Technology Security Research Centre and other such work units, to provide technical support to the Investigation Group, and strengthen the focus and efficacy of the inspection. Third, random spot checks. Each small inspection group randomly selected several critical information infrastructure operating work units according to the requirements of the inspection plan, and conducted preliminary spot checks unannounced. Six small inspection groups conducted random spot checks on 13 work units in total. 120 important information systems were monitored remotely, and were also selected randomly by the Law Enforcement Inspection Group, and monitoring was completed under circumstances where the operating work units was not aware of the matter.
II, The method and efficacy of implementing the “Law and Decision””
In recent years, all levels’ Party Committees and governments have earnestly organized study of General Secretary Xi Jinping’s series of important speeches and important judgments concerning cybersecurity, deeply implemented the Centre’s strategic arrangements concerning “building a strong cyber power”, entered cybersecurity into the overall picture of economic and social development and into comprehensive planning and arrangements, forcefully advanced cybersecurity and network information protection work, and legal implementation has seen vigorous results.
(1) Deeply conducting propaganda and education, strengthening cybersecurity awareness.
First, strengthening the entire people’s cybersecurity awareness has been made into a basic task. 9 departments including the Cyberspace Administration of China, the Ministry of Industry and Information Technology and the Ministry of Public Security have, for four successive years, organized and launched Cybersecurity Week and themed days and propaganda activities, lectures, forums, etc. during this period of events annually have exceeded 10.000 in number, with an annual average coverage of around 200 million people. After the promulgation of the Cybersecurity Law, all localities have conducted propaganda and explanation of the core content of the law through newspapers and magazines, radio and television stations, portal websites, governmental microblogs and public channels, etc. Second, strengthening legal propaganda and education in focus work units and focus sectors. The Ministry of Industry and Information Technology has entered learning about the “Law and Decision” into annual assessment standards for basic telecommunications operating enterprises, and organized learning sessions at focus Internet enterprises such as Baidu, Alibaba, Tencent, etc. The Ministry of Public Security has organized concentrated study sessions for the public security bodies nationwide, over 200 Central ministries and commissions as well as Central enterprises, and over 260 information security enterprises and related personnel. The State Administration of Press, Publications, Radio, Film and Television has organized cybersecurity knowledge and skill training and competition activities. Provinces (regions) such as Inner Mongolia and Heilongjiang have conducted focus training for professional backbones in focus work units and focus sectors who are responsible for cybersecurity. Third, closely grasping the critical minority of leading cadres, and making enhancing the cybersecurity awareness of leading cadres into the heaviest of heavies. Localities such as Guangdong and Fujian have promoted leading cadres to take the lead in knowing the law, understanding the law and using the law through organizing cybersecurity and informatization-themed deliberation classes for leading cadres, and other such methods. The Ministry of Traffic and Transportation Party Group’s members have taken the lead in study, and organized a “special training class for bureau-level leading cadres on cybersecurity”, the Ministry of education has organized cybersecurity training classes for the education system, and has conducted topical training for responsible persons in all provincial education administration departments, directly subordinate higher education institute and directly subordinate ministry bodies. All localities have made younger netizens into a focus point for law popularization, launched activities such as “cybersecurity entering campuses and entering households”, “strive to be a netizen with good ‘four haves'”, etc. guiding broad youth into going online in a lawful, civilized and healthy manner.
(2) Formulating accompanying regulations and policies, building cybersecurity structures and systems
In order to support the implementation of the “Law and Decision”, in recent years, relevant state Council departments have published the “National Cyberspace Security Strategy”, the “Telecommunications Cybersecurity Protection Management Rules”, the “Telecommunications and Internet User Personal Information Protection Regulations”, the “Telephone User Real Identity Information Registration Regulations”, the “Press, Publications, Radio, Film and Television Cybersecurity Management Rules”, the “Public Internet Cybersecurity Sudden Incident Emergency Response Plan” and other such accompanying riles, plans and policy documents. The Cybersecurity Administration of China has, together with relevant departments, published the “Some Opinions concerning Strengthening National Cybersecurity Standardization Work”, accelerated the formulation work of cybersecurity standards, and 198 national cybersecurity standards have been published. The Supreme Court and the Supreme Procuratorate have published the “Interpretation concerning Some Questions on Applicable Law when Handling Criminal Cases of Infringement of Citizens’ Personal Information”. Some provinces have also launched accompanying regulation drafting work, the Inner Mongolia Autonomous Region People’s Congress Standing Committee formulated the “Computer Information System Security Protection Rules”, the Fujian Province People’s Congress Standing Committee passed the “Fujian Province Telecommunications Infrastructure Construction and Protection Regulations”, the Guangdong Province People’s Congress Standing Committee published the “Decision concerning Implementing Telecommunications Users Real Identity Information Registration System”, the Heilongjiang Province People’s Congress Standing Committee published the “Industrial Information Security Management Regulations”. Chongqing Municipality persisted in equally stressing cybersecurity and informatization development, strengthening the construction of e-government systems and perfecting governmental website management structures. A series of accompanying regulations, rules and policy documents have been published, assisting in the implementation of the “Law and Decision”.
(3) Enhancing security protection capabilities, striving to ensure the security of network operations
First, strengthening critical information infrastructure protection. In 2016, the Cyberspace Administration of China and other departments organized the launch of critical information infrastructure investigation and inspection work, they conducted spot-checks and technological surveys of 11.000 important infrastructure systems’ operational security state, completed cybersecurity risk assessments in multiple focus sectors including finance, energy, telecommunications, transportation, radio and television, education, healthcare, social security, etc., putting forward over 4000 improvement suggestions. Second, launching network infrastructure protection work. The Ministry of Industry and Information Technology has launched network infrastructure investigation work, completely combing through network infrastructure and information systems, at present, all sectors in total have been determined to contain 11590 critical network infrastructure systems and important information systems. Since 2017, over 900 focus network systems and industrial control systems have been subject to supervision and spot-checks, and 78980 vulnerabilities have been notified for rectification. Third, deeply advancing multi-level cybersecurity protection. 140.000 information systems have already been filed, among whom 1.7000 are third-tier or higher important information systems, this basically covers all critical information infrastructure. At the same time, regularized inspection has been launched for information systems entered into multi-level protection, in recent years, the total of all kinds of security vulnerabilities that have been discovered and rectified approaches 400.000. Fourth, establishing reporting and early warning systems. The Ministry of Public Security has taken the lead in establishing a national cybersecurity reporting and early warning mechanism, with a notification scope already covering 100 Central Party and government bodies, 101 Central enterprises, 31 provinces (regions, municipalities) and the Xinjiang Production-Construction Corps, all localities have also established cybersecurity and information security notification mechanism, to notify and deal with all kinds of vulnerabilities and threats in real time. The Ministry of Education has established security supervision and early warning mechanisms for important websites and information systems in the education system, having already handled 35.000 security threats in total. Fifth, vigorously launching the construction of coordinated joint action platforms for cybersecurity. The Cyberspace Administration of China has taken the lead in establishing emergency response technology support and assistance mechanisms for critical information infrastructure, it has incessantly upgraded the overall emergency response capabilities, security protection capabilities and coordinated joint action capabilities for critical information infrastructures. Sixth, forcefully conducting cybersecurity special campaign work. The Ministry of Public Security has, together with relevant work unit, conducted large-scale special Internet enterprise defence campaigns, website security, as well as Internet and email security special governance campaigns, discovering and rectifying a batch of deep cybersecurity problems and vulnerabilities.
(4) Controlling information violating laws and regulations, and safeguarding a clear and crisp cyberspace
All localities and all relevant departments have earnestly implemented the requirements of the law, soundly performed online ideological work, and firmly cleaned up information violating laws and regulations of all kinds. Through launching a series of campaigns including “sweeping pornography and beating illegality”, the “Web Sword” etc., targeting information propagating terror, violence, obscenity or sex, etc. on Internet sites, application software, blogs, microblogs, public accounts, instant messaging tools or online streaming. Since 2015, the Cyberspace Administration of China and other departments have, according to the law, held talks with over 2200 websites violating laws or regulations, cancelled the permit or filing of websites breaking laws or regulations or closed unlawful websites in over 13.000 cases, relevant websites have, according to user service agreements, closed nearly 10 million accounts violating laws or regulations, creating a powerful deterrence against all kinds of online unlawful conduct. The China Youth Daily Social Survey Centre provided the inspection group with a large-scale survey analysis report (hereafter simply named “mass survey report” which suggests that among the 10370 people participating in the survey, over 90% of respondents affirm the efficacy of governance, and 63,5% among them believe that information violating laws and regulations online including information harming national security, propagating terror, violence, obscenity or sex has clearly reduced. The legal implementation competent departments have also established an online information patrol mechanism and public reporting platforms, to timely clean up information violating laws and regulations. Chongqing and other such localities give high regard to strengthening online content construction, vigorously creating excellent online works and strengthening online positive propaganda.
(5) Strengthening personal information protection, attacking unlawful and criminal infringement of user information security
In comprehensively implementing real identity system requirements for online access (website filing and domain names / IP addresses), fixed telephones and mobile telephones, in all cases where users do not provide real identity information, operators no longer provide related services to them. In the past five years, telecommunications enterprises have organized the accompanying registration of 300 million old users who had not yet submitted their real name, and ceased the provision of services according to the law to over 10 million users who refused to amend their registration. In order to ensure user information security, relevant departments have guided all network operating work units to further strengthen internal control and management structures, requiring them to implement strict management over application, use and period of validity of major operations such as mass data export, reproduction, information deletion, etc., preventing the mass leak of user information through workflows. Henan Province has strengthened security protection of critical systems for user information storage, enhancing capabilities to protect against hacking attacks. With regard to the trend of high incidence of user personal information crimes, the Ministry of Public Security has arranged and launched a dedicated attack campaign, establishing anti-fraud centres in 31 provinces (regions, municipalities) and the Xinjiang Production-Construction Corps, it comprehensively coordinated the attack against the use of citizens’ personal information to conduct telecommunications and online fraud crimes, in the past two years, over 3700 cases of criminal infringement of personal information were cracked, and over 11.000 criminal suspects were arrested. Between 2014 and September 2017, courts nationwide tried 1529 criminal cases where networks were used to infringe citizens’ personal information, gaining relatively good legal effects and social effects.
(6) Expanding support strength, advancing critical cybersecurity technology innovation.
In order to implement the requirements of the Cybersecurity Law to “support focus cybersecurity technology industries and projects, and support the research, development and utilization of cybersecurity technology”, the Ministry of Science and Technology, jointly with the Cyberspace Administration of China, composed dedicated research plans, based on the current development status of cyberspace security, focusing on raising our country’s critical information infrastructure and data security protection capabilities, supporting trusted management of cyberspace and data asset protection, enhancing cyberspace protection capabilities and other such goals, this established research directions in several focus points. In order to expand support to research, development and application support of cybersecurity technology the Ministry of Science and Technology and the Ministry of Industry and Information Technology gave priority to initiating the “Cyberspace Security Focus Earmarks” in the “13th Five-Year Plan Period” national focus research and development plan, with a State-issued funding input of 1.384 billion Yuan, they systematically arranged 47 research tasks, striving to basically create an indigenous and controllable core cybersecurity technology system by the year 2020. Furthermore, in the “Science and Technology Innovation 2030 – Major Projects”, they gave priority to arranging a batch of major cybersecurity research projects, providing technical support to enhancing our country’s information supervision and management, leak and theft of confidential information prevention, cyber defence, etc. The Ministry of Education has innovated cybersecurity talent education models, adding a first-tier cyberspace security discipline, issuing the “Opinions concerning Strengthening Cybersecurity Discipline Construction and Talent Training” together with relevant departments, initiating first-rate cybersecurity academy construction demonstration projects, and thus providing talent support for cybersecurity technology innovation.
III, Difficulties and problems existing in work
The inspection situation shows that various localities still display some difficulties and problems in implementing the “Law and Decision” and in safeguarding aspects of cybersecurity.
(1) Cybersecurity awareness urgently remains to be strengthened
Many critical information infrastructure operating work units have an insufficient understanding of the importance of cybersecurity, they believe that their being cyberattacked is only a low-probability matter, and they lack understanding of the harm from cyberattacks they may receive. In the area of informatization, they are “high on construction, low on security; high on use, low on protection”, they lack awareness about active defence, and are unwilling to conduct the necessary investment in security protection; when handling the relationship between the usability and security of business information systems, they often more emphasize usability, and when there is a conflict with the later, often reduce security requirements. Quite a few local governments’ and departments’ leading cadres cannot understand cybersecurity from the height of national security, they have not entered cybersecurity work on the important work agenda for that level’s government or department, or they only give it priority in name, “saying it is easy, but treating it as secondary, and forgetting it when busy”. The social public’s cybersecurity awareness is generally not strong, the “Mass Survey Report” indicates that 55,4% of respondents believe that many people around them lack a cybersecurity awareness, and “know that cybersecurity exists but do not know much about it”.
(2) Basic cybersecurity construction is generally weak
First, the construction of cybersecurity state sensing platforms is lagging behind. Cybersecurity risks have a strong hidden component, sensing the security state is the most basic and fundamental work to do cybersecurity well. In safeguarding cybersecurity, it is first and foremost necessary to know where the risks are, what the risks are, and when the risks emerge. But quite a few provinces have not yet initiated the construction of cybersecurity state sensing platforms, they cannot realize all-weather, real-time, dynamic monitoring of the cybersecurity risk in important information systems. Second, the construction of disaster-proof back-up systems is generally lagging behind. Quite a few work units operating critical information infrastructure relating to the national economy and the people’s welfare have not conducted remote disaster-proof backups of important data according to legal provision, but have only adopted several simple data back-up measures, some have even not conducted disaster-proof backups, and cannot effectively respond to major data security risks. In several provinces, multiple important information systems have not conducted remote disaster-proof backups according to legal requirements. Third, indigenization levels in important industrial control enterprises’ equipment and control systems remains to be increased. Several important industrial control enterprises heavily rely on foreign technology, not only are production control systems built by foreign companies, but foreign products are also used as accompanying network and security equipment, the deployment of network and security equipment is controlled by foreign personnel, enterprises’ internal personnel even does not hold security equipment deployment and management powers. In some provinces, the indigenization level of important industrial control enterprises’ production control systems is less than 20%. Fourth, emergency response plans are treated as a mere formality. Some cybersecurity emergency response plans are biased towards the elimination of equipment blockages, and their content dealing with cyberattacks, information leaks and other such cyberspace security incidents is relatively limited; some emergency response plans lack feasibility; some emergency response plans have not been revised for a long time, and can no longer respond to the present type of cybersecurity incidents; many work units have not truly organized emergency response drills because they have insufficient conditions to have emergency response drills; quite a few localities and sectors have insufficient funds to be used to resolve cybersecurity problems, and after problems are discovered, they can often not be resolved timely because of funding shortages.
(3) Prominent cybersecurity risks and vulnerabilities
In order to understand the situation of online operations, the law enforcement inspection group entrusted the China Information Security Monitoring Centre with conducting remote penetration tests and vulnerability scans of 120 randomly selected critical information infrastructure systems (60 portal websites and 60 operational systems). This Centre issued a report that stated that among the 120 critical information infrastructure systems undergoing remote monitoring, 30 contained security vulnerabilities, including 12 high-risk vulnerabilities, some provincial-level departments’ comprehensive Internet supervision and management platforms among them contained three high-risk vulnerabilities of unauthorized uploads, unauthorized downloads, and unauthorized deletion, gravely threatening the security of systems and servers, they also contained grave risks of user information leaks. The remote monitoring also discovered that multiple city-level government portal websites contained the risk that pages might be distorted. The law enforcement inspection group’s on-sit spot checks discovered that multiple work units have not retained network daily records according to laws and regulations, this may lead to the impossibility to timely conduct tracing and response measures when a cybersecurity incident occurs; some work units have not conducted risk assessments of important information systems, and lack knowledge of the cybersecurity situation they may face. The inspection also discovered that in multiple work units, the security construction of intranets and private networks has not been given sufficient attention, some work units have not arranged for any security protection equipment of their intranet systems, and not conducted vulnerability scans for a long time, and thus major cybersecurity risks exists. Following the advance of informatization construction in all areas and all localities, the datafication, onlinification and remotization of all sectors and all areas is becoming ever clearer, putting forward higher requirements for cybersecurity.
(4) The situation in user personal information protection work is grim
The “mass survey report” demonstrates that the implementation of many structures in the “Law and Decision” concerning user personal information protection is not ideal: 52.1% percent of interviewees believe that the provisions in the law concerning “online service providers and other enterprise and undertaking work units must, when collecting and using citizens’ personal electronic information during their business operations, indicate the purpose, method and scope for the collection and use of information” has been implemented badly or mediocrely; 49.6% of interviewees have encountered excessive collection of personal information, and 18.3% among them have regularly encountered excessive collection of user information; 61.2% of people have encountered “dictator clauses” where relevant enterprises use their own advantageous position to force the collection and use of user information, and if this is not accepted, the product in question cannot be used, or services received; 52.5% of people believe that law enforcements’ protection of user information has ordinary or bad results, quite a few people reflect that after discovering that their personal information was leaked or abused, it was relatively widespread that reporting was difficult, filing complaints was difficult, and filing cases was difficult. Many interviewees reflected that the problems of excessive collection of user information and infringement of personal privacy exist in a widespread manner in free-of-charge applications, but it seems as if there is no supervision, management or lawful punishment whatsoever. The investigation discovered that some Internet companies and public service departments stored large amounts of citizens’ personal information, but security protection technology was gravely lagging behind, making it easy for law-breakers to steal and abuse it. Several work units’ internal control systems are not perfected or not implemented, a small number of “inside ghosts” have taken the risks in pursuit of unlawful gain, leading to large-scale leaks of user information. In several places at present, the use of networks to illegally collect, steal, peddle and use users’ information has created black industry chains. Cases recently uncovered by public security department recently demonstrate the features of user information leaks such as they have multiple channels, costs for unlawful acts of theft are low, the difficulty of investigation is high, etc., furthermore, law-breakers’ used methods are incessantly improving, cases of “targeted fraud” triggered by user information leaks are increasing, creating grave harm to the popular masses’ asset security.
(5) Cybersecurity law enforcement structures remain to be further smoothened
The phenomenon of “nine dragons ruling the water” in cybersecurity supervision and management still exists, problems such as unclear duties and responsibilities, each fighting their own battles, law enforcement shifts responsibility, efficiency is low, etc., still have not been effectively resolved, the comprehensive coordination role with which the law endowed cybersecurity and informatization departments has been insufficiently unhindered. In several localities, multi-headed management problems in network and information security are relatively prominent, but after information leaks, abuses of user personal information and other such information security incidents occur, users regulatory run into the problems that there is no door to complain to, or departments shift responsibility between them or dispute over trifles. The “mass survey report” reveals that 18.9% of interviewees reflect that, after encountering cybersecurity problems, they do not know which department to go to to file a report or complaint, and even if they have reported the matter, it is often not dealt with or there is no result. Multiple network operating work units participating in the discussions reflect that problems exist in administrative law enforcement, such as different law enforcement departments conduct duplicate inspections of the same work unit or the same item, and even that inspection standards are not identical, different law-implementation competent departments collect data but “interconnection and interaction” cannot yet be realized, regularly bringing increased and extra burdens to network operators. Quite a few people believe that if it is impossible to rationally structure and precisely delineate duties and responsibilities between departments, it will lead to the problem that law enforcement is not coordinated in the process of implementing the multi-level protection system and critical information infrastructure protection system. Furthermore, the investigation discovered that urban rail transport control systems and other such industrial control systems have unclear cybersecurity management responsibility boundaries, operating work units’ implementation of cybersecurity responsibility contains difficulties; supervision, management and administrative law enforcement powers in the telecommunications sector are gravely insufficient, law enforcement forces are not suited to the present sever situation that cybersecurity incidents occur at high frequency.
(6) Accompanying regulations to the Cybersecurity Law remain to be perfected
Quite a few work units reflected that as the basic law in the area of cybersecurity management, quite a few elements from the Cybersecurity Law are principle-type provisions, and true “implementation” still relies on the perfection of accompanying regulations. For example, even though the Cybersecurity Law contains provisions on data security and use, data operations in practice are relatively complicated, and data desensitization standards, inter-enterprise data sharing norms etc. still need relevant regulations and rules to clarify them; the Cybersecurity Law only clarified that critical information infrastructure operators’ data export activities require assessment, but it has not further clarified whether a security assessment is to be conducted for the export of important data held by other network operators. The critical information infrastructure protection system is an important system in the Cybersecurity Law, but understandings at present are not yet uniform with regard to what is critical information infrastructure, standards and procedures to designate critical information infrastructure, etc. this needs to be clarified through accompanying regulations. How critical information infrastructure is to conduct annual inspections and evaluations, how network operators and management departments are to uniformly publish cybersecurity early warning information, how to support indigenous intellectual property rights in cybersecurity, etc., are also waiting for accompanying regulations and rules to be clarified.
(7) There is a cybersecurity talent shortage
Among the 10370 people participating in the investigation, over 69% of interviewees believe that within their work unit or among the people they know, the specialist technical talents who are able to engage in cybersecurity protection with skill is relatively low in number, it is impossible to satisfy real needs, 21.6& among these interviewees believe that within their work unit, there is basically no-one who is well acquainted with cybersecurity protection technology. The investigation situation shows that, regardless of whether a region is economically developed or relatively backward, cybersecurity technology talents are relatively lacking in all cases, existing network operating work units’ technology talents are mostly biased towards systems use, operational maintenance, their capability for cybersecurity risk supervision and control, emergency response and comprehensive defence is insufficient, and it is difficult to respond to the needs of protecting cybersecurity. Some critical information infrastructure core business systems, even though protection systems are installed, upgrades or patches cannot be applied to security software because of a lack of high-level security technology talent, and so this means cybersecurity security protection products can play an effective role with difficulty. Quite a few government portal websites do not have specialized cybersecurity technology talents, website management personnel has not accepted systematic cybersecurity skills training. Furthermore, cybersecurity competent departments’ specialized talents are clearly insufficient in number. Under factor constraints such as personnel appointment, duties, remuneration, etc., many local cybersecurity and informatization, public security, telecommunications management, industry and information technology, and other which work units often are unable to recruit or retain specialized technical talents, first-line law enforcement personnel’s specialist training and skills can hardly gain competence for regularized supervision, management and law enforcement duties for network operational security.
IV, Some suggestions
On the basis of the inspection situation, the inspection group has put forward the following suggestions for further implementing the “Law and Decision”.
(1) Further raising understanding of the importance of cybersecurity
In the information age, cybersecurity has become the fifth space outside terrestrial, maritime, aerial and outer space, it has become a new frontier for national interests and a new area for the strategic game between all major countries worldwide, cybersecurity can affect the entire picture of national security with one move, it has become a national security problem of a fundamental and comprehensive nature. The 19th Party Congress report stressed that cybersecurity and other such non-traditional security matters are one of the common challenges that humanity faces, we must persist in the overall national security view, make the people’s security into the purpose, make political security into the foundation, comprehensively manage external security and internal security, territorial security and citizens’ security, traditional security and non-traditional security, our own security and common security, perfect national security structures and systems, and strengthen the construction of national security capabilities. We must further deepen understanding of the importance of strengthening cybersecurity work under new circumstances, incessantly strengthen our sense of urgency and self-consciousness in implementing the Cybersecurity Law and other such laws and regulations. The competent departments for implementation of law and other related work units must, in integration with their work reality, further strengthen propaganda and training about the Cybersecurity Law, incessantly let the broad network operators, critical information infrastructure operating work units and their relevant personnel be able to know the content of the law, they must also strengthen propaganda for the social public in ways that are pleasing to see and hear, let the broad public understand the close relationship between cybersecurity and themselves, and strengthen the cybersecurity awareness of all of society.
(2) Correctly dealing with the relationship between security and development.
General Secretary Xi Jinping pointed out that cybersecurity and informatization are mutually accompanying. Security is the precondition for development, development is the guarantee for security, security and development must be advanced simultaneously. We must fully understand the role of the Internet in state management, economic development and social governance, continue to advance e-government, e-commerce and new smart city construction, incessantly enhance technological convergence, operational convergence and data convergence, create information “arteries” for economic and social development. We must, according to the requirements in the Cybersecurity Law to “equally stress maintaining cybersecurity and informatization development”, persist in grasping network and informatization development with one hand, and grasping cybersecurity with the other, “grasp with both hands, both hands must be tight”. In cybersecurity, we must give high regard to traditional information security and ideological security, and create a cyberspace with a clear atmosphere, brimming with positive energy, we must also give high regard to enhancing capabilities to defend against attacks, effectively prevent cyber attacks, and realistically safeguard the security of networks and information systems. We must scientifically formulate cybersecurity standards for different sectors and different work units, and earnestly research and resolve the problem that “cybersecurity compliance costs are excessively high” put forward by several work units. Encourage and support the development of the cybersecurity industry, give rein to the role of social forces, and provide secure products and services.
(3) Accelerate the perfection of accompanying regulations and rules of the Cybersecurity Law.
We must accelerate the legislative progress of the “Critical Information Infrastructure Protection Regulations” and the “Cybersecurity Multi-Level Protection Regulations”, make clear provisions on issues that, in practice everyone universally feels are difficult to grasp, such as what is critical information infrastructure, how to determine critical information infrastructure, etc., and further clarify the departmental duties and responsibilities in the process of implementing the multi-level protection system and the critical information infrastructure protection system. Cybersecurity and informatization, telecommunications and public security departments must formulate accompanying regulations or documents as quickly as possible, and create detailed structure for elements of the law such as personal information and important data export security assessment, online data management, cybersecurity monitoring and early warning, information reporting, cybersecurity review, cybersecurity certification and security monitoring result mutual recognition, etc. Several administrative regulations and departmental rules already formulated earlier should also be timely corrected and perfected on the basis of the requirements of the Cybersecurity Law as well as new issues and new questions that were encountered. On the basis of the need to prevent and attack online unlawful and criminal acts, strengthen Internet criminal legislation, research the formulation of a law to prevent and address online unlawful and criminal acts, and promote the effective linkage of administrative punishment and criminal punishment of online unlawful and criminal acts.
(4) Striving to enhance cybersecurity protection capabilities
First, accelerating cybersecurity state sensing platform construction. We must integrate resources from all departments to establish a unified all-weather cybersecurity sensing platform, in order to discover risks and sense risks well, and thereby build uniform and high-efficiency cybersecurity risk discovery mechanisms, notification mechanisms, intelligence sharing mechanisms, deliberation and response mechanisms, and to accurately grasp the laws, trends and tendencies occurring in cybersecurity risks. Second, organizing and conducting risk assessment according to the law. We must, as quickly as possible, perfect cybersecurity risk assessment mechanisms, strengthen assessment in important sectors and areas such as finance, energy, transportation, etc., and on the basis of the assessment situation, adjust cybersecurity work plans and protection measures at suitable times. Third, regularly organizing emergency response drills. Organize critical information infrastructure operating work units to regularly conduct emergency response drills, to ensure that important information systems involving national security, or involving the national economy and the people’s livelihoods to be able to effectively respond against organized, high-strength cyberattacks. Fourth, we must earnestly implement the requirements of the law, accelerate the construction of disaster-proof backups in critical information infrastructure, and regularly conduct testing of their disaster-proof efficacy, enhancing the capabilities of information systems to be resilient to disasters, mitigate disasters and recover. We must supervise network operating work units in earnestly implementing the provisions of the law and preserve network daily records according to the law. Fifth, we must strengthen the construction of cybersecurity confidentiality protection systems, enhance the capabilities of cybersecurity secrecy protection equipment, and enhance the construction of cybersecurity secrecy protection technology safeguard infrastructure. Sixth, we must forcefully advance the domestic production replacement project. Strengthen technological research and development, progressively raise the degree of domestically produced content in information control systems in important industries and enterprises, and increase the indigenous and controllable capabilities in critical information infrastructure and cybersecurity equipment.
(5) Progressively strengthening users’ personal information protection
First, we must accelerate the progress of the personal information protection legislation. Through specialized legislation, clarify the principles and procedures for network operators to collect user information, clarify their secrecy protection and [general] protection duties of collected information, and the liability they shall bear for improper use and weak protection, as well as supervision, inspection and assessment measures. Second, strengthening security protection. Strengthen the construction of data security supervision and management methods, implement tiered and categorized management for data resources, promote the research, development and deployment of security technologies for preventing data disclosure, preventing distortion and preventing leaks in the big data landscape. Third, we must earnestly research the scope and methods for user real-name registration systems, and resolutely avoid the problems that information collection subjects are excessively many in number, and real-name registration items are excessive. All localities and aal work units shall have a clear legal basis for any real identity registration system. We must enhance real identity information collection methods, and reduce the content of real identity information content. Fourth, strengthening supervision and inspection. Establish third-party assessment mechanisms, supervise network operators and public service work units in strictly collecting user information according to the law, establishing and completing internal management mechanisms, and effectively reducing the risk of “inside demons” stealing data. Fifth, further strengthening attack. Public security bodies must strengthen the attack against cyberattacks, online fraud, online harmful information and other such unlawful and criminal activities, sever online criminal profit chains, continue to shape a high-pressure situation, implement the provisions of the law on protecting citizens’ personal information, and ensure that the broad citizens’ lawful rights and interests are not harmed. Sixth, we must perfect complaints reception mechanisms. Research the establishment of uniform and highly effective user information security incident complaint reception mechanisms, to provide a convenience for user complaints and reporting, and safeguard the popular masses’ lawful rights and interests.
(6) Strengthening comprehensive coordination in cybersecurity work
Cybersecurity work involves many domains, has a broad scope, brings heavy tasks, great difficulties, and is strongly systemic, general and coordinated in nature. To respond to complex cybersecurity situations, we must ensure uniform planning, uniform arrangements, uniform standards and uniform progress. We must incessantly perfect online law enforcement coordination mechanisms, complete standardized law enforcement suited to the features of networks as quickly as possible. We must implement regulations related to the Cybersecurity Law, strengthen the construction of cybersecurity law enforcement teams and law enforcement capabilities, strengthen the comprehensive coordination duties and responsibilities of cybersecurity and informatization departments, clarify the boundaries of and interfaces between all functional departments’ powers and responsibilities, create coordinated action mechanisms for departments including cybersecurity and informatization, industry and information technology, public security, secrecy protection, etc., we must both prevent functional overlap and multi-headed management, while also avoiding a pushing away of law enforcement responsibilities, and blank spots in management, incessantly raise law enforcement efficiency, effectively safeguarding cyberspace security. Considering the strong cross-regional nature of the Internet, and the fact that land boundaries are not clear, we must complete and perfect cybersecurity non-local law enforcement cooperation mechanisms, and realize interregional law enforcement joint action. We must also eliminate departmental interests, cut through data and information barriers, reduce duplicate construction, establish shared data platforms, substantially ensure that data collected by different departments can be shared, and raise cybersecurity protection capabilities.
(7) Accelerating the construction of cybersecurity talent teams
Cybersecurity is one of the areas where technological renewal happens the most quickly, competition in cyberspace fundamentally is a competition over talent; to construct a cyber power, the most crucial resource is talent. We must give high regard to cybersecurity talent training work, we must not only foster technical talents proficient in information system use and protection, but we must also foster large batches of talents who are able to conduct cybersecurity risk supervision and control, emergency response and comprehensive protection, and thereby satisfy the demands put forward in the implementation of the Cybersecurity Law. We must further strengthen the construction of cybersecurity academic disciplines, optimize the structuring of teacher teams, reform talent fostering models, foster ever more applied talents who can satisfy practical requirements. We must encourage reforms of network and informatization talents develop mechanisms systems and mechanisms to be conducted and trialled with priority, research the establishment of cybersecurity special talent training, management and incentive mechanisms, strengthen fostering, guidance and support of high-end cybersecurity talents and urgently required talents, ensure that Party and government bodies and critical information infrastructure operating work units are able to find and recruit, use well and can retain “high-end, capable and sharp” specialized talents proficient in cybersecurity technology.
At present, the Internet has deeply merged with all areas of economic development and social life, it has profoundly transformed people’s ways of production and life. We must earnestly study and comprehensively implement the spirit of the 19th Party Congress and especially Xi Jinping Thought on Socialism with Chinese characteristics for a new era, further raise our political stance, firmly establish correct cybersecurity views, further strengthen our sense of urgency and sense of awareness in implementing the law, advance all structures of the “Law and Decision” towards complete implementation, substantially safeguard cyberspace sovereignty and the direct personal interests of the popular masses, and provide firm guarantees for victoriously constructing a moderately prosperous society, gaining magnificent victories for Socialism with Chinese characteristics in a new era, and realizing the Chinese Dream of the great rejuvenation of the Chinese nation.