3 ms·
I read the follow-up blog post with details[1] as well as the actual Chinese regulation text[2]. The blog post seems to omit a lot of details and some claims ar
by oefrha 7y ago
I read the follow-up blog post with details[1] as well as the actual Chinese regulation text[2]. The blog post seems to omit a lot of details and some claims are dubious.
I don’t have time to translate everything, but here’s an example quote from the blog post:
> The inspectors can fully access the system and they are permitted to copy any data they find. See Article 15.
Whereas Article 15 reads (even if you can’t read Chinese, Google Translate will probably do a reasonable job)
> ... look up and/or copy information on matters related to the audit and inspection of Internet security. ...
So this is quite vague (not really surprising for any regulation), but at face value the law doesn’t seem to say “fully access” or “any data”. Does this cover any data that has nothing to do with security? Ostensibly not. Realistically I’m not sure. Either way, citing the law with an exaggerated translation doesn’t promote confidence in the blog post.
[1] https://www.chinalawblog.com/2019/10/chinas-new-cybersecurity-system-there-is-no-place-to-hide.html https://www.chinalawblog.com/2019/10/chinas-new-cybersecurit...
[2] http://www.gov.cn/gongbao/content/2018/content_5343745.htm http://www.gov.cn/gongbao/content/2018/content_5343745.htm
Edit: to be absolutely clear, I was only commenting on the part of the blog post with explicit citations. Most of the blog post speculates on intent and actual scope, but since those are speculative and don’t deal with the text of the law directly, the author is of course entitled to his own interpretations.
- dangerface 7y agoArticle 15 seems specific to pen testing at least thats what I think they mean by "public security organs" > Article 13 Public security organs conducting Internet security supervision and inspection may conduct on-site supervision and inspection or remote inspection.
- TrueDuality 7y agoThat sounds to me like it's authorizing them to remotely "access" the computers and networks, and failing that they can perform an on-site inspection. So yeah pentests, not necessarily with the corporation's knowledge...
- oefrha 7y agoArticle 16 says subjects must be notified of remote inspections, including the time and scope; or said inspections must be published ahead of time. Remote inspections must not disrupt normal functioning of the subject’s systems. Again, I’m only talking about the written text of the law.
- devicetray0 7y agoWhere do you get pentesting from? This translation sounds like it could mean anything from an audit to full-packet capture.
- oefrha 7y agoOkay, to be fair to the blog post, I overlooked this later in the article: > Though Article 10 “restricts” access to matters involving national security, the definition of national security in China is so broad that there is no real limitation on what can be accessed, copied and removed. Well, if you say so.
- president 7y agoDon't make the same mistake as others and get caught up in fine print and small details with China. This type of thinking is exclusive to the West. Chinese "law" is just a formality so you really need to just understand what their desire is as they will go to any lengths to achieve it. The fact that they even published text here shows that they have doubled-down on ensuring that you know that you play by their rules.