The Diplomat author Mercy Kuo regularly engages subject-matter experts, policy practitioners, and strategic thinkers across the globe for their diverse insights into U.S. Asia policy. This conversation with Dr. Aynne Kokas – associate professor of Media Studies at the University of Virginia; C.K. Yen Chair at the Miller Center for Public Affairs, and author of the forthcoming book “Trafficking Data: How China is Winning the Battle for Digital Sovereignty” (Oxford, November 2022) – is the 337th in “The Trans-Pacific View Insight Series.”
Explain China’s politics of data governance and pursuit of cyber sovereignty.
The Chinese government asserts cyber sovereignty, or control over all of China’s digital resources, including servers, user data, technical infrastructure, and tech firms operating in China, both within the country and globally. China’s 2017 Cybersecurity Law requires firms that offer critical information infrastructure in China (broadly defined) to store their data on Chinese government-run servers, allowing the Chinese government access to resources like Apple’s China-based iCloud data. Extending that oversight outside of China, the 2020 Hong Kong National Security Law gives the Chinese government control over what it deems as crimes against China’s national security committed outside of Hong Kong, including issues related to data protection. Finally, China’s 2021 Data Security Law empowers the Chinese government to conduct national security audits over firms operating in China that gather user data. These laws are just the tip of the iceberg of China’s efforts to extend data oversight beyond its borders.
Analyze how China networks sovereignty in the United States.
The Chinese government extends sovereignty in the United States by using networked platforms to assert control over Chinese firms that operate in the United States and U.S. firms that operate in China. Firms and users willingly participate in this trade in goods and services for convenience, profitability, or entertainment.
Take TikTok, for example: While the firm has made significant efforts to create a firewall between its U.S. and Chinese businesses, its parent company ByteDance remains subject to Chinese government data security audits. As a firm with a dominant presence in the Chinese market through its Chinese social media platform Douyin, ByteDance doesn’t have the luxury of exiting the Chinese market. Yet because the Chinese government has designated TikTok’s algorithm as a national security asset, ByteDance also does not have the option of spinning off its TikTok business. TikTok is the most well-known example, but similar dynamics exist for firms across a wide range of sectors. In my book, I profile everything from farm tools to baby monitors.
What is most important to note about how China networks sovereignty is how China’s efforts to extend its cyber sovereignty in the United States build on how the U.S. tech landscape already exploits user data.
If Chinese social media platforms function as critical infrastructure, as you posit, how are they used as surveillance tools?
Social media platforms exemplify the exploitative model of U.S. data governance and how that can amplify China’s global digital oversight. Many users are aware that their actions face surveillance on social media. And indeed, surveillance or censorship of users posting politically sensitive content about Hong Kong or Xinjiang has drawn media attention to Chinese platforms like WeChat and TikTok.
However, the form of surveillance that more often gets overlooked is what such platforms can do with all the data they collect, surveilling not just individual users but how entire social networks and communities function. Such insights are invaluable for generating and spreading disinformation on those same platforms. They can serve as the backbone of future products that appeal to users more successfully because of their attractive algorithm.
Describe China’s methods and magnitude of surveilling biodata.
Biodata surveillance is rapidly evolving because of the rapid shifts in China’s COVID-19 policy. The Chinese government has taken the lead globally in developing networked tools to monitor citizens and their movement during the COVID-19 pandemic. Such monitoring occurs through codes issued to individuals called jiankangma, or health codes, that shape how citizens can move based on their known exposures and health symptoms.
Outside China, Chinese tech firms like Xiaomi gather user biodata through consumer products that monitor everything from heart rate to activity level. Chinese labs also are certified to process tests from the U.S. due to the open system of laboratory standardization in the United States. Most people in the United States don’t realize that HIPAA does not protect their health data internationally. Thus, biodata from the U.S. can supply the Chinese National GeneBank DataBase.
Assess U.S. policy and commercial efforts to counter China’s digital sovereignty.
The U.S. is in a dilemma. Exploitative data ecosystems that monetize the everyday lives of users with only the most minimal illusions of consent built Silicon Valley. Scholar Shoshana Zuboff refers to this as “surveillance capitalism.” U.S. tech firms have long been an engine of U.S. national power, strengthening the U.S. economy, attracting the best tech talent from around the world, and extending U.S. influence globally. The Chinese government’s efforts to gather user data in the United States build on these exploitative practices. Yet, with China’s efforts to expand cyber sovereignty, the features of this system become bugs.
Tech firms, both U.S.- and Chinese-based, have become too big to regulate by the United States government. Efforts to regulate Big Tech in the Federal Trade Commission have proven difficult. Disagreements within and between political parties have delayed efforts to protect user data security through bills like the American Data Privacy and Protection Act. Presidential Executive Orders from both the Biden and Trump administrations faced significant pushback from U.S. firms. China, by contrast, does not allow foreign social media platforms, strictly controls any data gathering by foreign firms, and enjoys a much freer hand when regulating Chinese tech firms.