Notice concerning Further Strengthening Management over Cultural and Artistic Programmes and Their Personnel
National Radio and Television Administration General Office
Guang Dian Ban Fa (2021) 267
All provincial, autonomous region and municipal radio and television bureaus, the Xinjiang Production-Construction Corps Culture, Sports, Radio, Television and Tourism Bureau, the Central Radio and Television Station Office, the Film Channel Programme Centre, the China Education Television Station:
In recent years, radio, television and online audiovisual cultural and artistic programmes have stressed quality, stressed style and stressed responsibility, and resisted vulgar, lowbrow and base tastes, incessantly pushed out excellent works, satisfying the popular masses’ spiritual and cultural needs. In order to further strengthen management, strictly deal with problems that artists violate the law and leave virtue behind, the “fan circle” mess, etc., and to establish a sectoral atmosphere of love for the Party and love for the country with all flags flying, of high virtue and noble art, hereby, the relevant matters are notified as follows:
I, Persisting in resisting unlawful and unvirtuous personnel. Radio and television bodies and online audiovisual platforms must strictly keep the gate in terms of programme actors and guest choices, and persist in making political quality, virtuous character, artistic levels and social evaluation as criteria for choice. Personnel with an incorrect political standpoint, who have dissension and discord with the Party and the country is resolutely not to be selected; personnel who violate laws and regulations and smash society’s baseline of fairness and justice is resolutely not to be selected; personnel who violate public order and fine customs, and whose acts and conduct are without virtue or norms is resolutely not to be selected.
II, Persisting in opposing the only-ratings-theory. Radio and television bodies and online audiovisual platforms may not broadcast idol cultivation-type programmes, they may not broadcast comprehensive arts, entertainment and reality shows where stars’ sons and daughters participate. Talent-type shows must strictly control the setup of the voting segment, they may not set up segments and channels outside of the venue for voting, ranking, reinforcement, etc., it is strictly prohibited to guide or encourage fans to covertly spend money to vote by materialized methods such as purchasing goods, pledging memberships, etc, and the harmful “fan circle” culture is to be resolutely resisted.
III, Persisting in resisting excessive entertainmentization. Persist in cultural self-confidence, forcefully hold high China’s excellent traditional culture, revolutionary culture and advanced Socialist culture. Establish a correct aesthetic orientation for programmes, strictly grasp actor and guest choice, acting styles, dress and make-up, etc, resolutely resist “sissies” and other such abnormal aesthetics. Resolutely resist excessive entertainmentization tendencies of playing up bragging about wealth and hedonism, rumours about sex scandals and personal lives, negative hot topics, vulgare “Internet celebrities”, anti-aesthetics without baselines, etc.
IV, Persisting in resisting high-value remuneration. Strictly implement remuneration regulations for actors and guest, strictly implement their remuneration management notification commitment system. Advocate and encourage actors and guests to bear social responsibility, and participate in public benefit-type programmes. Strictly punish violation of remuneration regulations, “yin-yang contracts”, and tax evasion activities.
Substantially strengthen employee management. Strictly implement that presenters must hold credentials to take up positions, standardize presenters’ participation in social activities and online information dissemination. Strengthen employees’ political quality training, deeply launch education on the Marxist view of news and view on culture and art, persist in the people’s standpoint from beginning to end, stick to the people’s mood. Perfect professional ethical norms, strengthen the construction of professional ethics, consciously resist the temptations of fame and wealth, professional identities and individual fame may not be used to seek improper gain, consciously accept social supervision, and be a model of social virtue and a builder of positive energy.
VI, Launching dedicated and authoritative culture and art criticism. Persist in the correct political orientation, public opinion orientation and value orientation, carry forward the true, the good and the beautiful, reject the false, the evil and the ugly, give full rein to the roles of values in guidance, spirits in leadership and aesthetic in enlightenment. Put social effect and social value first, unify profound thoughts, profound art and excellent production, and evaluate programmes strictly and objectively. Scientifically treat audience ratings, click ratings and other such quantified indicators, and strengthen the expansion and application of “China audiovisual big data”.
VII, Giving full rein to the role of sectoral organizations. Radio, television and online audiovisual sectoral associations and other such sectoral organizations must further perfect sectoral standards and self-discipline conventions, vigorously launch moral appraisal. Strengthen education and training on ideology and politics, professional ethics, etc., establish regularized training mechanisms, optimize teaching content, strengthen case-based teaching, discuss the law through cases, and demonstrate the law through cases. Criticize harmful phenomena in the sectors and negative models with clear banners flying, resolutely oppose circle culture and sectoral corrupt customs, effect a thorough overhaul, and safeguard the benign atmosphere in the sector.
VIII, Substantially implement management duties and responsibilities. Administrative radio and television departments must raise their political stance, earnestly implement ideology work responsibility systems, further compact and substantiate local management responsibilities, competence and supervision responsibilities and dominant responsibilities, guard the culture and art programme orientation gate, content gate, personnel gate, remuneration gate and propaganda gate well. We must pay high regard to listening to the calls of the popular masses, vigorously respond to the concerns of the popular masses, resolutely say “no” to law-breaking and immorality, playing up stars, excessive entertainmentization, “supremacy of ratings” etc., and let the main melody and positive energy fill the radio, television and online audiovisual space to the brim.
It is hereby notified
National Radio and Television Administration General Office
2 September 2021
All provincial, autonomous region and municipal Party Committee cybersecurity and informatization offices, the Xinjiang Production-Construction Corps Party Committee Cybersecurity and Informatization Office”
Since the “Clear and Crisp ‘Fan Circle’ Mess Control” campaign was held, all localities have implemented relevant work requirements, and have gained certain achievements focusing on star rankings, trending topics, fan communities, interactive comments and other such focus segments, and deeply dealt with the problem of the “fan circle” mess. In order to further strengthen control, bring greater and substantial pressure to the dominant responsibilities of websites and platforms, make substantial breakthroughs in focus and difficult issues, incessantly consolidate and expand the achievements of the campaign, attack and resolve the “fan circle” mess with a heavy fist, hereby, relevant work measures are notified as follows.
1. Cancel star and artist rankings. Cancel all rankings and lists involving individual stars and artists or groups, prohibit newly adding or covertly uploading individual rankings and related products or functions. Only rankings of music works, film and television works, etc. may be maintained, but no individual characteristic such as stars’ or artists’ names may appear.
2. Optimize and adjust ranking rules. When ranking music works, film and television works, etc., reduce the weight of registries, likes, comments and other such indicators, and increase the weight of indicators such as the work’s orientation and expert evaluation. Related functions that lead users to make lists may not be set up, paid-for registration functions or increasing registry numbers through added-value memberships and other such methods may not be set up, guide fans to pay more attention to the quality of cultural products, and reduce the heat of chasing stars.
3. Strictly manage star brokerage companies. Strengthen website platforms’ management responsibilities over the online conduct of star brokerage companies (offices), formulate related online operational standards, and make clear provisions concerning account registration and verification, content dissemination, commercial marketing, crisis PR, fan management and other such online conduct. Strengthen the responsibility of star brokerage companies (offices) to guide fan communities, adopt measures such as limiting flow, prohibition of speech, closure, etc., against stars and their brokerage companies (offices), fan groups and their accounts who incite mutual rifts of fans, struggles and incitements of battles, at the same time, the entire platform will reduce and even cancel all kinds of information dissemination related to [those] stars.
4. Standardize fan community accounts. Strengthen management of accounts of stars’ fan communities, backers, etc. require that fan communities and backers must be authorized or accredited by the star’s brokerage company (office), and their daily maintenance and supervision becomes the latter’s responsibility. Without authorization, no individual or organization may, without exception, register a star fan community account.
5. Strictly prohibit the emergence of mutual ripping information. Substantially implement management responsibilities, timely discover and clean up all kinds of harmful “fan circle” information where fans mutually tear at each other or hurl abuse, drag and trigger fights, start rumours and attacks, etc., strictly deal with accounts violating laws and regulations, effectively prevent heating up and fermentation of public opinion. Strictly punish website platforms where discovery is not timely and management is insufficient.
6. Clean up community pages violating regulations. Continue to dissolve fan communities and groups with themes such as rank voting, reinforcement, collecting money, controlling comments, gossip, explosive materials, etc., close boards, channels, etc. that easily lead to fans collecting and exchanging their ranking experiences, discuss stars’ sex scandals, mutually assign data scraping, etc, and block channels that generate harmful inducements to fans and encourage stirring up of trouble.
7. Fans may not be incited to consume. Formulate detailed rules that stars’ and artists’ magazines or other works, products, etc., in the sales segment, may not display fans’ individual purchase amounts, contribution amounts and other such data, may not rank fans’ individual product purchase data or amounts, may not set up marketing activities that stimulate fans to consume such as task-based unlocking, custom-made benefits, limited-time PK, etc.
8. Strengthen segment setup and management. Strengthen management of online arts and entertainment programmes’ online conduct, they may not set up “spend money to buy votes” functionalities, and are strictly prohibited from guiding or encouraging netizens to vote for candidates by material methods such as purchasing products, memberships etc.
9. Strictly control participation by minors. Further adopt measures to strictly prohibit minors from playing for rewards, it is strictly prohibited that minors respond to calls for consumption, minors may not act as related community heads or managers, minors are restricted from voting for rankings, clarify that star fan communities, backers, etc. may not, in their online conduct, influence minors’ regular study and rest, and may not organize minors to launch all kinds of online assemblies, etc.
10. Standardize reinforcement and fund-raising activities. Timely discover and clean up all kinds of information on calling for reinforcements and raising funds isolating regulations; deal with and punish website platforms where problems are concentrated, accountability is weak, who induce minors to participate in calls for reinforcement and fundraising according to laws and regulations; continue to investigate and prosecute foreign websites who provide ranking votes, reinforcement calls and fund-raising.
All localities must further raise their political stance, substantially strengthen their sense of responsibility, sense of mission and sense of urgency, and understand and advance their work in bringing the “fan circle” mess under control from the height of online political security and ideological security, and creating a clear and crisp cyberspace. They must, in the first instance, arrange and implement matters, take further steps to break the matter down, formulate detailed implementation plans, and supervise local website platforms’ realistic grasp and implementation of these.
25 August 2021
Chinese Banking and Insurance Supervisory Commission Notice concerning Further Standardizing Commercial Banks’Internet Lending Operations
YBJBF No. (2021)24
All banking supervisory bureaus, all large-scale banks, shareholding-type banks and foreign invested banks:
In order to promote commercial banks to effectively implement the “Provisional Rules for the Management of Commercial Banks’ Online Lending” (hereafter referred to as “Rules”), further standardize Internet lending operations and activities, stimulate the healthy development of the business, with the agreement of the CBIRC, the following notification is made on related matters:
I, Implementing risk control requirements. Commmercial banks shall strengthen their dominant responsibility in risk control, independently conduct Internet lending risk management, and autonomously complete lending risk assessment and risk control steps with an important influence for risk control, they are strictly prohibited from outsourcing crucial steps in management before, during and after loans.
II, Strengthening capital issue proportion management. Where commercial banks jointly issue capital for Internet loans with cooperating bodies, they shall strictly implement interregional capital issue proportion management requirements, the capital issue proportion from the cooperating party for a “single pen loan” [a loan not repayable in installments] may not be lower than 30%.
III, Strengthening management of concentration of cooperating party. Where commercial banks jointly issue capital for Internet loans with cooperating bodies, the balance of that bank’s lending issued with any one cooperating party may not exceed 25% of the net amount of that bank’s first-tier capital.
IV, Implementing aggregate control and quota management. The balance of Internet loans where commercial banks jointly issue capital with cooperating bodies may not exceed 50% of that bank’s total lending balance.
V, Strictly controlling cross-regional operations. Where banks with local legal personality conduct Internet lending activities, they shall serve local customers, they may not conduct Internet lending operations outside of the jurisdiction where they are registered. Those who do not have physical operational branches, who mainly conduct operations online, and furthermore conform to other CBIRC regulations and conditions are exempt.
VI, Article 2 and Article 5 of this Notification take effect from 1 January 2022, operational inventories will be settled naturally, the transition period for other provisions is consistent with the “Rules”. The CBIRC and its assigned bodies will, according to the principles of “one bank one policy, steady transition”, supervise commercial banks in formulating rectification plans for Internet lending operations that do not meet the requirements of this Notice, and in completing rectification within the notification period. Commercial banks meeting conditions are encouraged to meet targets early.
VII, The CBIRD and its assigned bodies may put forward stricter precautionary supervision and management requirements concerning capital issue proportions, concentration of cooperating bodies, Internet lending amounts and quotas on the basis of the operational management, risk levels and operational conduct status of commercial banks under their jurisdiction, and on the basis of the provisions of this Notice.
VIII, Foreign bank branches, trust companies, consumer finance companies or car finance companies conducting Internet lending operations will refer to and implement the requirements of this Notice and the “Rules”, where the CBIRC provides otherwise, those provisions are followed.
CBIRC General Office
19 February 2021
Guiding Opinions concerning Further Perfecting Structures to Restrain Trust-Breaking and Building Long-Term Mechanisms for Sincerity Construction
GBF No. (2020)49
All provincial, autonomous region and municipal People’s Governments, all State Council ministries and commissions, all directly subordinate bodies:
In order to deeply implement the requirements of the Party Centre and the State Council concerning enhancing sincerity construction, earnestly implementing the “Regulations on Optimizing the Commercial Environment” and other such relevant regulations, further clarify the scope of credit information, impose punishment for trust-breaking according to laws and regulations, perfect credit recovery mechanisms for untrustworthy subjects, and raise the rule of law and standardization levels of social credit system construction, with the approval of the State Council, the following Opinions are hereby put forward.
I, General requirements
With Xi Jinping Thought on Socialism with Chinese characteristics for a new era as guidance, comprehensively implement the spirit of the 19th Party Congress and the 2nd, 3rd, 4th and 5th Plenums of the 19th Party Congress, firmly take seeking progress in stability as a general foundation for work, firmly follow rule of law tracks, strive to build long-term mechanisms for sincerity construction, further standardize and complete mechanisms for the establishment, recording, collecting, sharing, publication, punishment and credit recovery of untrustworthy acts according to the general thinking lines of acting according to laws and regulations, protecting rights and interests, exercising caution and moderation, and checklist-based management, push the social credit system to enter a new phase of high quality development, let the social credit system play an even more positive role in supporting “release, management, service” reform and the transformation of government functions, creating a fair and sincere market environment and social environment.
In the process of advancing and practically exploring social credit system construction work, we must grasp the following important principles: first, strictly act according to laws and regulations, the recording to untrustworthy acts, determining name lists of gravely untrustworthy subjects and punishment for untrustworthiness, and other such matters affecting the direct rights and interests of related individuals, enterprises and all other kinds of subjects, must be handled strictly along rule of law tracks. Second, define scopes accurately, accurately determine the assessment scope for credit information and name lists of gravely untrustworthy subjects, reasonably handle punishment measures for untrustworthiness, firmly prevent improper application and even abuse. Third, ensure punishment is matched to the error, implement different kinds and different degrees of punitive measures strictly according to the law, respectively according to the area in which the untrustworthy act took place, the gravity of the circumstances, the extent of its impact, etc, and ensure the lawful rights and interests of credit subjects are protected. Fourth, lean from international experiences, both act on the basis of our country’s national circumstances, and fully consider international precedents, advance social credit construction cautiously in areas of high social attention, where understandings are not yet in agreement, and push related measures to link tracks internationally.
II, Scientifically determine the scope and processes for public credit information entry
(1) Clearly determine the scope for public credit information. The entry of information on particular acts held by public bodies and organizations authorized by laws and regulations to have public affairs management functions, etc. (hereafter jointly named administrative bodies) into public credit information must be strictly based on laws, regulations or Party Centre and State Council policy documents, and a catalogue system implemented to manage it. The leading work unit of the Interministerial Joint Conference for Social Credit System Construction (hereafter simply named Interministerial Joint Conference) compiles and regularly renews a basic nationwide public credit information catalogue according to laws and regulations, and together with relevant departments, the Interministerial Joint Conference’s member work units and other relevant departments may, according to laws and regulations, put forward suggestions for information to be entered into the catalogue, the Interministerial Joint Conference’s leading work unit combs through them and collects a catalogue, solicits opinions from all localities, all relevant departments and related market subjects, sectoral associations and chambers of commerce, legal service bodies, exports, scholars and the social public, and after submission to the Interministerial Joint Conference for deliberation, [the catalogue] is published to society and its implementation organized. All localities may, on the basis of local regulations, and with reference to the formulation procedure for the basic nationwide public credit information catalogue, formulate supplementary public credit information catalogues suited to that locality.
(2) Strictly standardize bases for determining untrustworthy acts. Administrative bodies determining untrustworthy acts must have a document with legal validity as basis. The bases on which an untrustworthy act may be determined include: valid judicial judgment documents or mediation letters, documents on decisions of administrative acts such as administrative punishments, administrative arbitration, etc, as well as other documents where laws, administrative regulations or other Party Centre and State Council policy documents provide they may act as a basis for a basis determining an untrustworthy act. After administrative bodies determine an untrustworthy act, they shall truthfully record the untrustworthy act.
III, Standardize the scope and process for public credit information sharing and openness
(3) Standardize the scope and process for public credit information sharing. Whether public credit information may be shared or in which scope it may be shared, shall be determined on the basis of the principles of legality and necessity, and determined at the time where public credit information catalogues are compiled. Perfect credit sharing mechanisms, promote the interaction and interconnection, and data sharing between the Nationwide Credit Information Sharing Platform, the National Enterprise Credit Information Publication System as well as relevant departments’ credit information systems, collecting departments must be clarified for data that may be shared, ensuring that “what is collected in one window, is fully shared”.
(4) Determine the scope for publication of public credit information according to laws and regulations. Whether public credit information may be published, shall be determined on the basis of the principles of legality and necessity, and determined at the time where public credit information catalogues are compiled. Public credit information publication may not infringe commercial secrets and personal privacy, where laws and regulations provide otherwise, those provisions are followed. Where information related to an individual is published, the basis in law, regulation, State Council decision or degree must be clarified or the individual in question must consent, and the necessary desensitization must be performed.
(5) Strengthen comprehensive management of public credit information publication channels. Departments determining public credit information shall, according to government information openness and other relevant regulations, publish the related information on that department’s portal website, all levels’ governments’ portal websites or other appointed websites. The “Credit China” website, and the National Enterprise Credit Information Publication System must, according to relevant regulations, conduct uniform publication of public credit information that is collected and shall be published, consistency is to be maintained on the content and time period of publication with the department determining public credit information.
IV, Standardize determination standards and procedures for name lists of gravely untrustworthy subjects
(6) Strictly limit the areas and scopes for the institutions of name lists of gravely untrustworthy subjects. Areas where a name list of gravely untrustworthy subjects ins instituted, must have a basis in laws, regulations or Party Centre or State Council policy documents, no department (work unit) may increase or expand them without authorization. The scope of the institution of name lists of gravely untrustworthy subjects is to be limited strictly to subjects responsible for grave harm to the physical health and life safety of the popular masses, gravely harm fair market competition order and regular social order, refuse to carry out statutory duties with grave influence on the credibility of judicial bodies and administrative bodies, refuse to implement national defence duties and other such grave unlawful and untrustworthy acts, according to the provisions of the “State Council Guiding Opinions concerning Establishing and Perfecting Joint Incentive Structures for Trust-Keeping and Joint Punishment Structures for Untrustworthiness, and Accelerating the Construction of Social Sincerity” (GF No. (2016)33).
(7) Strictly standardize determination standards for name lists of gravely untrustworthy subjects. For name list systems of gravely untrustworthy subjects implemented at the national level, the name list determination standards shall be determined in the form of laws, administrative regulations or Party Centre or State Council policy documents, those temporarily not meeting conditions may be determined by the competent (supervision) department of the area in question through departmental rules, for determination standards, the opinions of the Interministerial Joint Conference leading work unit and other relevant departments, related market subjects, sectoral associations and chambers of commerce, legal service bodies, experts, scholars and the social public shall be fully solicited, the period of public opinion solicitation shall not be less than 30 days. Determination standards shall be published through the “Credit China” website and websites appointed by the competent (supervision) department. Determination standards shall, at the same time, clarify conditions and procedures to leave the name lists as well as relief measures. Departments formulating determination standards shall regularly organize third-party assessment of the outcome of standards implementation and timely revise them. For name list structures for gravely untrustworthy subjects only implemented on a local scale, name list determination standards shall be provided in departmental regulations.
(8) Strictly implement determination procedures for name lists of gravely untrustworthy subjects. Administrative bodies shall, before making determination decisions about name lists of gravely untrustworthy subjects, notify the party concerned about the grounds and basis for the decision, and the rights the party concerned has according to the law; where the party concern raises an objection, this shall be verified and feedback made on the outcome within stipulated time limits. To list a market subject on a name list for gravely untrustworthy subjects, the determining department shall rely on corresponding administrative decision documents, bearing the grounds, basis, untrustworthiness punishment measure notes, withdrawal conditions and procedures as swell as relief measures, when necessary, it is also permitted for the determining department to produce a stand-alone determination decision document about name lists for gravely untrustworthy subjects. In principle, name lists for gravely untrustworthy subjects shall be determined by relevant departments of county-level and higher (including county-level) People’s Governments according to related standards, where laws, regulations and departmental rules provide otherwise, those provisions are followed.
V, Imposing punishment for untrustworthiness according to laws and regulations
(9) Determining punishment measures for untrustworthiness according to laws and regulations. Punitive measures reducing rights or adding to duties of untrustworthy subjects must be based on the facts of the concrete untrustworthy act, directly cite laws, regulations , or Party Centre or State Council policy documents as a basis, ad implement name list structure management. The work unit leading the Interministerial Joint Conference will, together with relevant departments, compile and regularly renew a nationwide basic list of punishment measures against untrustworthiness according to laws and regulations, member work units of the Interministerial Joint Conference and other relevant departments may, on the basis of laws and regulations, put forward suggestions on punitive measures for untrustworthiness to be included in the list, the work unit leading the Interministerial Joint Conference combs through them and collects a general list, solicits opinions from all localities, all relevant departments and related market subjects, sectoral associations and chambers of commerce, legal service bodies, experts, scholars and the social public, and after submission to the Interministerial Joint Conference, publishes [the list] to society and organizes implementation. All localities may, on the basis of local regulations, and with reference to the procedure for the formulation of the basic nationwide list for punitive measures against untrustworthiness, formulate supplementary lists of punitive measures against untrustworthiness suited to these localities. No department (work unit) may coercively require financial bodies, credit service bodies, sectoral associations, chambers of commerce, etc. to punish untrustworthy subjects.
(10) Ensure wrongdoings and punishments are proportional. According to the principles of legality, correlation and balance, according to the list of punishment measures against untrustworthiness, on the basis of the nature of the untrustworthy act and the extent of its gravity, adopt punitive measures of suitable weight, and prevent that small wrongdoings are punished heavily. No department (work unit) may, for the reason of existing regulations not sufficiently strongly punishing untrustworthy acts, expand punitive measures outside the provisions of laws, regulations, or Party Centre or State Council policy documents, or increase punishment on top of statutory punishment standards.
VI, Completing and perfecting credit recovery mechanisms
(11) Establishing and completing a set of credit recovery mechanisms. Related sectoral competent (supervision) departments shall establish credit recovery mechanisms beneficial to self-correction and active self-renewal. Except where laws, administrations, or Party Centre or State Council policy documents clearly provide untrustworthiness information cannot be recovered, where untrustworthy subjects correct the untrustworthy act according to requirements or eliminate the harmful influence, they may in all cases apply for credit recovery. Related departments (work units) shall formulate concrete regulations for credit recovery, clarifying recovery methods and procedures. Where they conform to recovery conditions, they will be timely removed from the name list of untrustworthy subjects according to relevant regulations, the sharing and publication of related untrustworthiness information ceases, or the related untrustworthiness information will be indicated, shielded off or deleted.
(12) Raising credit recovery rates. Strengthen credit recovery information sharing, accelerate the construction and perfection of coordinated and joint “running everything on one network” mechanisms, realistically resolve the problem that “credit recovery is difficult”. Related sectoral competent (supervision) departments as well as the Nationwide Credit Information Sharing Platform and the “Credit China” website shall appoint specialized personnel responsible for credit recovery work, and process credit recovery requests meeting conditions within statutory time limits, they may in no way collect fees from subjects applying for credit recovery.
VII, Strengthening information security and privacy protection
(13) Strengthening credit information security management. All levels’ public credit information systems must, according to the requirement of protecting market subjects’ rights and interests, clarify information inquiry and use privileges and procedures, establish and perfect information inquiry and use registration and inspection structures, and prevent information leaks, where information leaks intentionally or due to work errors, the responsibility of related work units and personnel must be prosecuted strictly, according to laws and regulations. Strictly investigate and prosecute acts of credit information leaks, distortion, damage and theft, or use of credit information to seek improper gain, strictly attack unlawful activities such as the illegal collection, sale or purchase of credit information under the guise of social credit system construction.
(14) Strengthening personal privacy protection. All localities and all relevant departments shall abide by the principles of legality, justification, necessity and minimization, collect and use personal credit information strictly according to the public credit information catalogue, clearly indicate the goal, method and scope of information collection and use and obtain consent from the person in question, where laws or regulations provide otherwise, those provisions are followed. It is prohibited for any work unit or individual to collect and use a person’s credit information without authorization, having coerced authorization or to do so life-long with a one-time authorization. Strengthen investigation and prosecution of the illegal collection, transmission, use, leakage, distortion, damaging, theft or sale of personal credit information and other such act. Related departments must implement focused supervision and management of financial bodies, credit investigation bodies, Internet enterprises, big data enterprises and mobile application software work units, and strictly standardize their personal information collection, storage, use, processing, transmission, provision and publication activities.
VIII, Striving to strengthen credit rule of law construction
(15) Accelerating the progress of credit law and regulation construction. Persist in following rule of law tracks, accelerate the research and advance of legislative processes for laws and regulations in the social credit area, smoothen the relationship between punishment for untrustworthiness and administrative management measures, lay a firm rule of law basis. Where the punitive strength of existing laws and regulations is insufficient, and it is necessary to strengthen punishment, all localities and all relevant departments shall put forward legislative revision suggestions in a timely manner, and ensure punishment for untrustworthiness is conducted strictly according to laws and regulations.
(16) Advancing social credit system construction strictly according to laws and regulations. Strictly standardize credit information, collection and publication scopes according to laws and regulations, strictly standardize determination of name lists of gravely untrustworthy subjects, punishment for untrustworthiness and credit recovery work, ensure that all areas of social credit system construction work operate along rule of law tracks. Minors’ untrustworthy acts, untrustworthy acts resulting from natural disasters, epidemics and other inevitable influences as well as acts with non-subjective intent or minor untrustworthy acts, shall be determined, recorded and punished in a tolerant and cautious manner. Firmly investigate, prosecute and attack all kinds of infringing acts, protect credit information security, commercial secrets and personal privacy according to laws and regulations, and protect the lawful rights and interests of all kinds of credit subjects according to laws and regulations.
IX, Strengthening organizational implementation safeguards.
Implementing dominant responsibilities. All sectoral competent (supervision) departments must realistically fulfil their dominant responsibility in supervising and managing credit in their sector, and perform untrustworthy conduct determination, recording, collection, sharing, publication, punishment and credit recovery work according to laws and regulations, the Interministerial Joint Conference’s leading work units must coordinate with judicial bodies as well as other responsible work units who have already obtained clear authorization in performing related work well. All local levels’ social credit system construction leading work units must realistically implement their comprehensive coordination responsibilities, and strengthen standardization and guidance of social credit system construction work in their areas.
Strengthening responsibility and accountability. With regard to recording, sharing and publication of credit information outside of public credit information catalogues and in violation of laws and regulations, implementing punitive measures outside of the punishment list for untrustworthiness in violation of laws and regulations, as well as acts such as unauthorized determination about name lists of gravely untrustworthy subjects not according to standards and procedures, not processing credit recovery timely or according to regulations, the liability of related work units and personnel must be prosecuted according to laws and regulations
Strengthening propaganda and explanation. All kinds of media are encouraged to vigorously conduct sincerity propaganda and education, deeply report on advanced models of sincerity and promise-keeping, launch constructive public opinion supervision of untrustworthy conduct and incidents, advocate sincerity and promise-keeping. Let relevant departments, sectoral associations and chambers of commerce, experts and scholars, news media, etc. play their role fully, timely explain and interpret credit policies, vigorously respond to concerns from all sides, strengthen positive guidance, and create a benign public opinion environment.
Grasping the moment. All localities and all relevant departments must, according to the requirements of these Opinions, conduct a comb-through and assessment of measures on untrustworthy conduct determination, recording, collection, sharing, publication, punishment and credit recovery measures already published, and those not meeting the requirements of these Opinions must be timely standardized. Set up a transitional period for name list structures of gravely untrustworthy subjects having a clear basis for their continued retention, complete renewal determination standards and procedures of name lists that these Opinions require to be adjusted before the end of 2021, after the transition period, those not conform to the requirements of these Opinions will be abolished without exception.
State Council General Office
7 December 2020
Internet Public User Account Information Service Management Regulations (Revision Draft – Opinion-seeking Version)
Chapter I: General provisions
Article 1: These Regulations are formulated in order to standardize Internet public account information services, safeguard national security and the public interest, and protect the lawful interests of citizens, legal persons and other organizations, on the basis of the “Cybersecurity Law of the People’s Republic of China”, the “Internet Information Service Management Rules”, the “Online Information Content Ecology Governance Regulations” and other such laws, regulations and relevant State provisions.
Article 2: These Regulations apply to the provision and conduct of Internet public account information services within the territory of the People’s Republic of China.
Internet public accounts as mentioned in these Regulations, refers to online accounts of Internet users registered and operated on Internet sites, application software and other such online platforms, to produce and disseminate written, pictorial, audiovisual and other such information content to the social public.
public account platform as mentioned in these Regulations, refers to online information service providers providing public account registration and operation, information content dissemination and technical protection services to Internet users.
Public account producers and operators as mentioned in these Regulations, refers to natural persons, legal persons and non-legal person organizations registering and operating public accounts and engaging in content dissemination.
Article 3: The national cybersecurity and informatization department is responsible for Internet public account information service supervision, management and law enforcement work nationwide. Local cybersecurity and informatization departments are, according to their duties and responsibilities, responsible for Internet public account information service supervision, management and law enforcement work within their administrative areas.
Article 4: Public service information service platforms and public account producers and operators shall abide by laws and regulations, fulfil social responsibilities and moral responsibilities, uphold the correct public opinion orientation and value orientation, carry forward the Socialist core value view, produce and disseminate healthy and upward, true and objective excellent information content, create a crisp and bright cyberspace, and stimulate progress of society and civilization.
All levels’ Party and government bodies, enterprise and undertaking work units, and people’s organizations are encouraged to register and operate public accounts, produce and disseminate high-quality government affairs information or public service information, satisfying public information demand, and promoting economic and social development.
Public service information service platforms are encouraged to vigorously enhance government affairs information publication, public service and social government levels for Party and government bodies, enterprise and undertaking work units, and people’s organizations, provide full and necessary technical support and security protection.
Article 5: Public account information service platforms providing Internet public account information services, shall obtain corresponding qualifications as provided in national laws and regulations.
Public service information service platforms and public account producers and operators shall obtain an Internet news information service licence to provide Internet news information services to the social public.
Chapter II: Public service information service platforms
Article 6: Public service information service platforms shall bear dominant responsibility for information content and public account management, allocate management personnel and technical capabilities suited to the business scale, appoint persons to position responsible for content security, establish, complete and strictly implement management structures for account registration, content examination and verification, information inspection, ecological governance, emergency response, cybersecurity, data security, personal information protection, copyright protection, credit evaluation, etc., and uphold the security of the platform’s information content and public accounts, and the security of data and personal information.
Public service information service platforms shall, on the basis of relevant laws and regulations and relevant State provisions, formulate and publish management norms and platform conventions for information content production, public account operations, etc., and conclude service agreements with public account producers and operators, clarifying both sides’ content dissemination limitations, account management responsibilities and other such rights and obligations.
Article 7: Public service information service platforms shall, according to relevant national standards and norms, establish categorized public account registration and categorized production structures, implement categorized management, and file the matter with the provincial, autonomous region or municipal cybersecurity and informatization department of the locality of the public account.
Public service information service platforms shall, on the basis of indicators and dimensions such as an account’s information content quality, the credit evaluation of the account’s subject, etc., establish tiered management structures, and implement tiered account management.
Public service information service platforms formulating content production and account operations management norms, platform conventions and other such important structures and measures shall file them with the local provincial, autonomous region or municipal cybersecurity and informatization department; when bringing related new technologies, new applications or new functions online, they shall conduct a security assessment according to relevant regulations.
Article 8: Public service information service platforms shall adopt measures such as composite verification, etc., to conduct real identity information authentication of Internet users applying to register for a public account, based on mobile telephone number, resident identity card number or unified social credit code and other such methods, and raise the accuracy of authentication. Where users do not provide real identity information, or improperly use real identity information of organizations, bodies or other persons to conduct a false registration, no related service may be provided to them.
Public service information service platforms shall conduct inspection of the legal and regulatory compliance of public account names, portraits, bios, etc. of public accounts registered by Internet users, where they discover an account name, portrait or bio does not conform to the subject’s real identity information, and especially where they use or link to Party or government bodies, enterprise and undertaking work units and other such organizations and bodies or well-known social personalities without authorization, as well as where the corresponding registration information contains unlawful or harmful information, they shall suspend the provision of services and notify the user to correct matters within a limited time, where these refuse to correct the matter, the provision of services shall be terminated.
Public service information service platforms shall prohibit public accounts closed according to the law or to the convention to re-register under a similar name; where an account name with a high degree of connectedness to them is registered, the real identity information, service qualifications, etc. of the account subject shall also be subject to necessary checks.
Article 9: Public service information service platforms shall require public accounts applying to register and engage in the production of information content in areas such as economics, education, health, judicial affairs, etc., require users to provide their specialized background at the time of registration, as well as corresponding materials to prove professional qualifications or service qualifications they have acquired according to laws and administrative regulations, and conduct the necessary checks.
Public service information service platforms shall add a special symbol to public accounts after they are checked and passed, and according to the different subject nature of the user, externally announce content production categories, the name of operating subjects, the registered business address, uniform social credit code, contact method and other such registration information, to facilitate social supervision and inspection.
Public service information service platforms shall establish dynamic checking and inspection structures, and at suitable times check the veracity and validity of registration information of producers and operators.
Article 10: Public service information service platforms shall set reasonable upper limits to the number of registered public accounts of the same subject on their platform. Where users apply to register for multiple public accounts, their subject nature, service qualifications, business scope, credit evaluation etc. shall also be checked.
Public service information service platforms may, on the basis of the service agreement suspend or terminate provision of services to public accounts who have not logged on or have been used for over six months after the Internet user registered.
Public service information service platforms shall complete technical measures to prevent and deal with unlawful registration acts by Internet users such as registration in excess of quota, malicious registration, false registration, etc.
Article 11: Public service information service platforms shall, according to the law and the convention, prohibit public account producers and operators to transfer, lend or illegally trade, sell or buy public accounts in violation of regulations.
Where public account producers and operators transfer or donate public account use rights to other users, they shall put forward an application with the platform. The platform shall, on the basis of the provisions in the previous Paragraph, authenticate and check the user on the receiving side, and publish the subject change information. Where the platform discovers a producer or operator has transferred a public account without inspection or authorization, it shall timely suspend or terminate the provision of services.
Public account producers and operators voluntarily terminating account operations may apply with the platform for suspension or termination of use. The platform shall suspend or terminate the provision of services according to the service agreement.
Article 12: Public service information service platforms shall establish public account supervision and assessment mechanisms, and prevent acts of falsification of account subscriptions, user following numbers, content click rates, repost or comment quantities and other such data.
Public service information service platforms shall standardize public account recommendation, subscription and following mechanisms, and complete technological measures to timely discover and deal with unusual changing circumstances in account subscription and following numbers. Without the knowledge and agreement of the Internet user, subscription and following of other users’ public accounts may not be forced.
Article 13: Public service information service platforms shall establish tiered credit management systems, and provide corresponding services on the basis of credit tiers.
Public service information service platforms shall establish and complete mechanisms to warn for, discover, trace, refute, delete and in other ways deal with online rumours and other such false information, and reduce the credit tier or blacklist public account producers and operators who produced and disseminated rumours and other such false information.
Article 14: Public service information service platforms shall, when conducting content supply and account recommendation cooperation with producers and users, standardize commercial activities such as management of advertising and operations, knowledge payment, e-commerce sales, user gratuities, etc., they may not disseminate false advertising, conduct exaggerated propaganda, commit commercial fraud, etc., preventing operations violating laws and regulations.
Public service information service platforms shall strengthen copyright protection of originally produced information content, preventing acts of piracy and infringement. Platforms may not abuse their advantaged position to interfere in the lawful and compliant operations of producers and operators, or infringe users’ lawful rights and interests.
Chapter III: Public account information producers and operators.
Article 15: Public account information producers and operators shall, on the basis of categorized platform management norms, at the time of registering the public account, accurately fill out user’s subject nature, registered location, business location, content production category, contact method and other such basic information, enterprises, organizations, bodies and other such Internet users shall also indicate their main activity or business scope.
Public account producers shall aide by platform management norms, platform conventions and service agreements, and engage in information content production and dissemination in the relevant sectoral area on the basis of the registered content production category indicated at the time of public account registration.
Article 16: Public account producers and operators shall bear dominant responsibility for information content production and public account operations and management, and engage in information content production and account operations and activities according to laws and regulations.
Public account producers and operators shall establish and complete information content security examination and verification mechanism for the entire process of topic planning, editing and production, dissemination and popularization, interactive comments, etc., strengthen gatekeeping over information content’s orientation, veracity and legality, and maintain a benign order in online communication.
Public account information producers and operators shall establish and complete security management mechanisms for the entire process of public account registration and use, operations and popularization, etc., manage and operate the account in a civilized, rational and standardized manner, attract the public’s attention, subscription, interaction and sharing with high-quality information content, and maintain a benign social image of the account.
Article 17: Public account producers and operators shall, when reposting information content originally created by other persons, abide by copyright protection-related laws and regulations, indicate the original creator and a traceable information source, and respect and protect the lawful rights and interests of copyright holders.
Public account producers and operators shall manage messages, posts, comments and other such interactive segments on their account. Platforms may, on the basis of the subject nature and credit tier of the public account, rationally set up management limits, and provide corresponding technological support.
Where public account producers and operators conduct account operations, content provision and other such cooperation with third-party bodies , both sides shall conduct checks and gatekeeping of the account’s operations and activities, supplied information content, etc.
Article 18: Public account producers and operators may not commit the following acts in violation of laws and regulations:
(1) Not registering with real identity information, or registering with a public account name, portrait, bio, etc. that is not conform with one’s own real identity information;
(2) Maliciously posing as, imitating or misappropriating the public account of an organization, body or other person to produce and disseminate information content;
(3) Providing Internet news information gathering, dissemination and other such services without a licence or in excess of a licence’s scope;
(4) Manipulatively using accounts on multiple platforms, to publish batches of homogenous information content, generating false flow data, and creating false public opinion hot spots;
(5) Using sudden public incidents to incite extreme emotions and acts, or commit online violence harming the reputation of other persons and organizations, influencing social harmony and stability;
(6) Fabricating false information, counterfeiting originally-created content, quoting or concocting untrue information sources, distorting facts and truths, misleading the social public;
(7) Using paid dissemination and deletion of information and other such methods to commit illegal online surveillance, marketing frauds, extortion and blackmail, in pursuit of improper gain;
(8) Registering in batches, hoarding or illegally trading, buying and selling public accounts;
(9) Producing, reproducing or disseminating unlawful information, or not adopting measures to prevent and resist the production, reproduction or dissemination of harmful information;
(10) Other acts prohibited in laws and administrative regulations.
Chapter IV: Supervision and management
Article 19: Public service information service platforms shall strengthen supervision and management of public service information service activities, and timely discover and deal with information or activities violating laws and regulations.
Public service information service platforms shall, on the basis of service agreements and platform conventions, adopt measures to deal with public accounts violating these regulations and relegated laws and regulations including warnings and alerts, limiting account functions, suspending content renewal, ceasing advertising dissemination, closing or cancelling accounts, blacklisting, termination of re-registration, etc., preserve relevant records, and timely report the matter to cybersecurity and informatization and other such relevant competent department.
Article 20: Public service information service platforms and producers and operators shall consciously accept social supervision.
Public service information service platforms shall set up eye-catching and convenient reporting interfaces, publish appeals, complaints and reporting methods and other such information, complete reporting information acceptance, screening, handling and feed-back mechanisms, clarify handling workflows and feed-back time limits, and timely and effectively deal with complaints by producers and operators, and complaints and reports from the public.
Internet sectoral organizations are encouraged to conduct public appraisal, promote strict self-discipline of public service information service platforms and producers and operators, establish authoritative mediation mechanisms with participation from multiple sides, fairly and relationally resolve sectoral disputes, and safeguard users’ lawful rights and interests according to the law.
Article 21: All levels’ cybersecurity and informatization departments will establish and complete coordinated supervision and management work mechanisms together with relevant competent departments, to supervise and guide public service information service platforms and producers and operators to conduct related information service activities according to laws and regulations.
Public service information service platforms and producers and operators shall cooperate with relevant competent departments’ lawful conduct of supervision and inspection, and provide the necessary technical support and assistance.
Where public service information service platforms and producers and operators violate these Regulations, cybersecurity and informatization departments and relevant competent departments will impose punishment according to relevant laws and regulations within their scope of duties and responsibilities.
Article 22: These Regulations take effect on (day, month) 2020.
第二十二条 本规定自2020年 月 日起施行。
Guiding Opinions on Implementing the Cybersecurity Multi-Level Protection System and Critical Information Infrastructure Security Protection System
Gong Wang An No. (2020)1960
All Centre and State bodies’ ministries and commissions, all bodies, office bodies and undertaking work units directly subordinate to the State Council, all Centre enterprises:
In order to implement the spirit of relevant Party Centre documents and the “Cybersecurity Law”, guide focus sectors and departments in comprehensively implementing the cybersecurity multi-level protection system and critical information infrastructure security protection system, complete and perfect the national comprehensive cybersecurity defence system, effectively prevent cybersecurity threats, forcefully deal with major cybersecurity incidents, coordinate public security bodies’ strengthening of cybersecurity supervision and management, strictly attack unlawful and criminal activities harming cybersecurity, realistically ensure the security of critical information infrastructure, important networks and data, the Ministry of Public Security has researched and formulated the “Guiding Opinions on Implementing the Cybersecurity Multi-Level Protection System and Critical Information Infrastructure Security Protection System”. These are hereby issued to you, please earnestly consult and implement them in combination with the work reality in your sectors and your departments.
Ministry of Public Security
22 July 2020
Guiding Opinions on Implementing the Cybersecurity Multi-Level Protection System and Critical Information Infrastructure Security Protection System
The cybersecurity multi-level protection system and critical information infrastructure security protection system are basic systems laid down in relevant Party Centre documents and the “Cybersecurity Law”. In recent years, all work units and all departments have comprehensively strengthened cybersecurity work according to the requirements of Central cybersecurity policies and the provisions of the “Cybersecurity Law” and other such laws and regulations, powerfully ensuring the security of national critical information infrastructure, important networks and data. Even though information technology develops at flying speed, cybersecurity work still faces several new situations, new tasks and new challenges. In order to implement the cybersecurity multi-level protection system and critical information infrastructure security protection system, complete and perfect the national cybersecurity defence system, effectively prevent cybersecurity threats, forcefully deal with cybersecurity incidents, strictly attack unlawful and criminal activities harming cybersecurity, realistically safeguard national cybersecurity, the following Guiding Opinions are hereby formulated.
I, Guiding ideology, basic principles and work objectives.
(1) Guiding ideology
With Xi Jinping Thought on Socialism with Chinese Characteristics in a New Era as guidance, according to the policy arrangements of the Party Centre and the State Council, with the overall national security view as the lead, earnestly implement the cyber power strategy, comprehensively strengthen overall cybersecurity work planning, with implementing the cybersecurity multi-level protection system and critical information infrastructure security protection system as basis, with protecting the security of critical information infrastructure, important networks and data as focus points, comprehensively strengthen work in areas such as cybersecurity prevention and management, monitoring and early warning, emergency response, investigation and attack, intelligence and information, etc., timely monitor and deal with cybersecurity risks, threats and sudden cybersecurity incidents, protect critical information infrastructure, important networks and data from attacks, intrusions, interference and destruction, punish online unlawful and criminal activities according to the law, substantially raise cybersecurity protection capabilities, vigorously build a comprehensive cybersecurity defence system, substantially safeguard national cyberspace sovereignty, national security and the social and public interest, protect the lawful rights and interests of the popular masses, ensure and stimulate the healthy development of economic and social informatization.
(2) Basic principles
– Persist in tiered protection, focus on prominent issues. On the basis of the degree of importance of networks (including network infrastructure, information systems, data resources, etc.) for national security, economic construction and social life, as well as factors such as the degree of harm after they should be destroyed, scientifically determine the security protection tier of networks, implement tiered protection and tiered supervision and management, focus on ensuring the security of critical information infrastructure and third-tier (including third-tier, hereafter similar) and higher networks.
-Persisting in active defence and comprehensive protection. According to laws, regulations and relevant State standards and norms, fully use artificial intelligence, big data analysis and other such technologies to vigorously implement cybersecurity management and technical protection measures, strengthen cybersecurity mentoring, state sensing, reporting and early warning, emergency response and other such major work matters, comprehensively adopt cybersecurity protection, defence and safeguard measures, prevent and curb the occurrence of major cybersecurity risks and incidents, protect the security of new technology applications and new business models such as cloud computing , the Internet of Things, the New Internet, big data, smart manufacturing, etc.
-Persisting in protection according to the law and creating joint forces. On the basis of the provisions of the “Cybersecurity Law” and other such laws and regulations, public security bodies fulfil cybersecurity protection, supervision and management duties and responsibilities according to the law, sectoral competent departments for cybersecurity (including supervision and management departments, hereafter similar) fulfil cybersecurity supervision and management responsibilities within their sectors according to the law, strengthen and implement the dominant protection responsibility of network operators, give full rein and muster forces from all parts of society, coordinate and cooperate, decide and work as team, and create cybersecurity protection work joint forces.
(3) Work objectives
– Deeply implementing the cybersecurity multi-level protection system. Cybersecurity multi-level protection tier determination and filing, tier monitoring and assessment, security construction, inspections and other such basic work matters are to be profoundly advanced. The “three izations and six defences” measures of “actualization, systematization and regularization” of cybersecurity protection and “dynamic defence, active defence, defence in depth, accurate protection, overall protection, joint defence and joint control” to be effectively implemented, a beneficial ecology for cybersecurity protection to be basically established, critical information infrastructure security protection capabilities to clearly strengthen.
– The critical information infrastructure security protection system to be established and implemented. Critical information infrastructure base numbers to be made clear, security protection bodies to be completed, responsibilities to be clarified, protection to be powerful. On the basis of implementing the cybersecurity multi-level protection system, critical information infrastructure-related critical position personnel management, supply chain security, data security, emergency response and other such focus protection measures to be effectively implemented, clearly strengthening critical information infrastructure security protection capabilities.
– Cybersecurity monitoring, early warning and emergency response capabilities to clearly increase. A cross-sector, cross-departmental and cross-regional three-dimensional cybersecurity monitoring system and cybersecurity protection platform to be basically completed, clearly raising cybersecurity state sensing, reporting, early warning and incident discovery and handling capabilities. Cybersecurity advance plans to be scientifically readied, emergency response and handling mechanisms to be perfected, emergency drills to be conducted in a regularized manner, major cybersecurity incidents to be effectively prevented, restrained and dealt with.
– A comprehensive cybersecurity prevention system to be basically created. Cybersecurity protection work mechanisms to be completed and perfected, a cybersecurity work structure with Party Committees in overall leadership, all departments taking responsibility according to the division of work, and social forces from many sides participating to be further perfected. The cybersecurity responsibility system to be effectively implemented, cybersecurity management, prevention, supervision, guidance, investigation and attack capabilities to clearly rise, and a comprehensive cybersecurity protection system integrating “attack, defence, management and control” to be basically created.
II, Deeply implementing the national cybersecurity multi-level protection system
According to the requirements oof the national cybersecurity multi-level protection system, all work units and all departments will, under the guidance and supervision of public security bodies, earnestly organize and deeply launch cybersecurity multi-level protection work, establish a beneficial cybersecurity protection ecology, substantially implement their dominant responsibilities, and completely enhance cybersecurity protection capabilities.
(1) Deepening network tier determination and filing work. Network operators shall comprehensively comb through all kinds of networks in their work unit, and especially the basic situation of cloud computing, Internet of Things, the New Internet, big data, smart manufacturing and other such new technological applications, and on the basis of the function of the network, its service scope, service counterparts, the data it handles and other such matters, scientifically determine the security protection tier of networks, second-level and higher networks will be filed according to the law with public security bodies, and filed with the sectoral competent department. Newly built networks shall be assigned a security protection tier in the planning and design phase. Public security bodies conduct examination and verification of the filing materials and network security protection tier submitted by network operators, where the tier determination result is reasonable and filing materials comply with requirements, they will timely issue cybersecurity multi-level protection filing certification. Sectoral competent departments may, on the basis of the national standard “Cybersecurity Multi-Level Protection Tier Determination Guidelines”, formulate guiding opinions for cybersecurity multi-level protection tier determination in integration with the characteristics of their sector.
(2) Regularly conducting cybersecurity tier assessments. Network operators shall, on the basis of relevant standards and norms, conduct monitoring and assessment of the security of networks with determined and filed tiers, and search for possibly existing cybersecurity problems and vulnerabilities. Third-tier and higher network operators shall entrust tier assessment bodies compliant with relevant State regulations to annually conduct a cybersecurity tier assessment, and timely submit the tier assessment report to the public security body and administrative competent department who received the filing. Newly-built third-tier and higher networks shall be put into operation after undergoing tier assessment. Network operators must, in the process of conducting assessment services, conclude a security and secrecy protection agreement with the assessment body, and conduct supervision and management of the assessment process. Public security bodies must strengthen supervision and management over tier assessment bodies in their localities, establish structures for the background inspection of assessment personnel and the examination and verification of personnel, and ensure that the tier assessment process is objective, fair and secure.
(3) Scientifically conducting security construction and improvements. Network operators shall, in the process of network construction and operation, simultaneously plan, simultaneously build and simultaneously use relevant cybersecurity protection measures. They shall, on the basis of the “Cybersecurity Multi-Level Protection Basic Requirements”, the “Cybersecurity Multi-Level Protection Security Design Technology Requirements” and other such national standards, and on the basis of existing security protection measures, completely comb through and analyse security protection requirements, and in integration with the problems and vulnerabilities discovered during the process of tier assessment, according to the requirements of “once centre” (security management centre), “three protects” (secure telecommunications networks, secure regional boundaries, secure computing environments”, earnestly conduct network security construction, improvement and consolidation, and comprehensively implement security protection technology measures. Network operators may move networks into the cloud, or outsource security services, fully using the capabilities and levels of cloud service companies and cybersecurity service companies to enhance cybersecurity protection. They shall comprehensively strengthen cybersecurity management, establish and perfect personnel management, education and training, system security construction and operational maintenance and other such management structures, strengthen management of computer rooms, facilities and medium security, strengthen the protection of important data and personal information, formulate operational norms and workflows, strengthen daily supervision and verification, and ensure the effective implementation of all management measures.
(4) Strengthening the implementation of security responsibility. Sectoral competent departments and network operators shall, on the basis of the requirements of the “Cybersecurity Law” and other such laws and regulations as well as relevant policies, and according to the principle of “who manages is responsible, who operates is responsible”, draw clear cybersecurity protection borders, clarify security protection work responsibilities, establish cybersecurity multi-level protection work responsibility systems, implement responsibility investigation structures, and ensure that “everyone has the responsibility to protect their land, and everyone does their utmost to protect their land”. Network operators must regularly organize dedicates forces to conduct cybersecurity inspections monitoring and assessment, sectoral competent departments must organize risk assessments, timely discover cybersecurity vulnerabilities and weak segments, and correct them, and incessantly raise cybersecurity protection capabilities and levels.
(5) Strengthening supply chain security management. Network operators shall strengthen the security management of critical network personnel, third-tier and higher network operators shall strengthen management over the bodies and personnel providing them with design, construction, operational maintenance and technical services, assess security risks that may exist in the process of services, and adopt corresponding management and control measures. Network operators shall strengthen network operations and maintenance management, where it is truly necessary to conduct Internet remote operational maintenance because of business needs, they shall provide an explanation of their assessment, and adopt corresponding management and control measures. Network operators shall purchase and use network products and services compliant with the requirements of State laws and regulations as well as relevant standards and norms, third-tier and higher network operators shall vigorously use secure and trustworthy network products and services.
(6) Implementing encryption security protection requirements. Network operators shall implement the provisions of the “Encryption Law” and other such laws and regulations as well as encryption us-related standards and norms. Third-tier and higher networks shall correctly and effectively adopt encryption technology for protection, and use encryption products and services compliant with related requirements. Third-tier and higher network operators shall, in the network planning, construction and operations stages, simultaneously conduct encryption use security assessment wat the same time as conducting cybersecurity tier assessment according to encryption use security assessment management rules and related standards.
III, Building and implementing the critical information infrastructure security protection system
Public security bodies guide and supervise critical information infrastructure security protection work. All work units and all departments shall strengthen the construction of legal systems, policy systems standards systems, protection systems, defence systems and safeguard systems for critical information infrastructure security, establish and implement critical information infrastructure security protection systems, and on the basis of implementing the cybersecurity multi-level protection system, give prominence to its protection focus, strengthen protection measures, and realistically ensure the security of critical information infrastructure.
(1) Organising the identification of critical information infrastructure. On the basis of relevant provisions of the Party Centre and the Ministry of Public Security, the competent and supervision and management departments (hereafter jointly named protection work departments) of important sectors and domains such as public telecommunications and information services, energy, transportation, waterworks, finance, public services, e-government, national defence science and technology and industry, etc., shall formulate critical information infrastructure identification norms for their sectors or domains and report them to the Ministry of Public Security for filing. Protection work departments are, on the basis of the identification norms, responsible for organizing the identification of critical information infrastructure in their sectors and domains, and to timely report the identification results to the related critical information infrastructure operators and to the Ministry of Public Security. They shall include focus protection counterparts such as basic networks meeting determination conditions, large-scale special networks, core business systems, cloud platforms, big data platforms, the Internet of Things, industrial control systems, smart manufacturing systems, the New Internet, novel telecommunications, etc., in critical information infrastructure. Critical information infrastructure lists will be subject to dynamic adjustment mechanisms, where relatively major changes occur in relevant network infrastructures and information systems, operators shall timely report the relevant circumstances to the protection work department, the protection work department shall organize re-identification, notify the operator about the identification result, and report the matter to the Ministry of Public Security.
(2) Clarifying the division of labour in critical information infrastructure security protection work functions. The Ministry of Public Security is responsible for the top-level design, planning and arrangement of critical information infrastructure security protection work, and completes and perfects the critical information infrastructure security protection structures and systems together with relevant departments. Protection work departments are responsible for organizational leadership over critical information infrastructure security protection work in their sectors and their areas, as well as formulating and implementing general plans and security protection tactics for critical information infrastructure security in their sectors and their areas, and implementing critical information infrastructure security guidance and supervision responsibilities within their own sectors and areas. Critical information infrastructure operators are responsible for the establishment of a specialized security management body, organizing and conducting critical information infrastructure security and protection work, whose main responsible person bears overall responsibility for the work unit’s critical information infrastructure security protection.
(3) Implementing focus protection measures for critical information infrastructure. Critical information infrastructure operators shall, on the basis of the cybersecurity multi-level protection standards, conduct security construction and conduct tiered monitoring, and must timely correct problems, risks and vulnerabilities they find; on the basis of critical information infrastructure security protection standards, strengthen security protection measures and conduct security monitoring and assessment. We must comb through network assets, establish asset files, strengthen the management of personnel in core positions, integrate protection with monitoring and early warning, emergency response and handling, data protection and other such focus protection measures, reasonably differentiate fields and areas, reduce the Internet’s disclosure surface, strengthen cyberattack threat control, strengthen defence-in-depth, vigorously use technologies to conduct cybersecurity protection, build a cybersecurity protection system with encryption technology, trusted computing, artificial intelligence, big data analysis etc. at the core, incessantly enhance the inherent security of critical information infrastructure, and capabilities for active immunity and active defence. Operators meeting conditions shall establish their own security services body, undertaking critical information infrastructure security protection tasks, they may also raise cybersecurity specialized and intensified protection capabilities through migrating to the cloud or purchasing security services and other such measures.
(4) Strengthening the protection of important data and personal information. Operators shall establish and implement a protection structure for important data and personal information security, conduct disaster-proof backups of important networks and important databases in critical information infrastructure, adopt critical technological measures such as identity differentiation, access control, encrypted protection, security audits, security isolation, trusted verification, etc. to substantially protect the security of important data in its entire lifecycle. Operators shall store personal information and important data collected and produced during their domestic operations inside the territory, where they need to provide it abroad because of business requirements, they shall abide by relevant regulations and conduct a security assessment.
(5) Strengthening the security management of personnel in core positions as well as products and services. We must conduct a background security inspection of responsible persons in specialized security management bodies and personnel in critical positions, and strengthen management. We must implement security management over critical information infrastructure design, construction, operations, maintenance and other such services, purchase secure and trustworthy network products and services, and ensure supply chain security. Where the purchase of products and services may influence national security, a security review shall be undergone according to relevant state regulations. Public security bodies strengthen security management over critical information infrastructure security service bodies, and provide support for operators conducting security protection work.
IV, Strengthening cooperation and coordination in cybersecurity protection work
Sectoral competent departments and network operators must closely cooperate with public security bodies, forcefully conduct security monitoring, reporting, early warning, emergency response, threat intelligence and other such work, implement regularized measures, enhance their capabilities to respond to and deal with sudden cybersecurity incidents and major risk prevention and control.
(1) Strengthening the construction of a three-dimensional cybersecurity monitoring system. All work units and all departments must comprehensively strengthen cybersecurity monitoring, conduct real-time monitoring of critical information infrastructure, important networks, etc., and when they discover cyberattacks and security threats, immediately report them to public security bodies and relevant departments, and adopt effective measures to deal with them. They must strengthen the research and applications of new network technologies, research and draw up cyberspace topography information maps (network maps), and ensure map-based battle. Sectoral competent departments and network operators must construct cybersecurity protection operations platforms for their sector and their work unit, build smart platform brains, , and rely on the platform and big data to conduct real-time monitoring, reporting, early warning, emergency response, security protection, command and control and other such work, and link up with public security bodies’ relevant security protection platform, creating a comprehensive defence and control structure integrating hierarchical and local links, connecting vertical and horizontal links, in a coordinated and jointly acting manner. Focus sectors, network operators and public security bodies must establish cybersecurity supervision and control command centres, implement a 24-7 duty staffing system, and create regularized and actualized cybersecurity work mechanisms.
(2) Strengthening cybersecurity information sharing reporting and early warning. Sectoral competent departments and network operators must, with the support of the national cyber and information security information notification mechanism, strengthen the construction of cyber and information security notification and early warning capabilities, timely collect, pool and analyse all sides’ cybersecurity information, strengthen threat intelligence work, organize the conduct of cybersecurity threat analysis and state research and argumentation, and timely notify early warnings and responses. Third-level and higher network operators and critical information infrastructure operators must conduct cybersecurity monitoring, early warning and information notification work, timely receive and deal with cybersecurity early warning notifications and information coming from the national level, sectoral level and local level, and notify cybersecurity monitoring and early warning information as well as cybersecurity incidents to sectoral competent departments, filing public security bodies. Public security bodies must strengthen the construction of cyber and information security information circulation and early warning mechanisms and forces, and incessantly raise cybersecurity notification and early warning capabilities.
(3) Strengthen the construction of cybersecurity emergency response mechanisms. Sectoral competent departments and network operators must, according to relevant State requirements, formulate cybersecurity emergency response plans, strengthen cybersecurity emergency response force construction and emergency response resource stockage, closely cooperate with public security bodies to establish a cybersecurity incident reporting structure and emergency response mechanisms. Critical information infrastructure operators and third-tier and higher network operators shall regularly conduct emergency response drills, effectively respond to cybersecurity incidents, and timely correct and consolidate prominent problems, leaks and vulnerabilities discovered during emergency response drills, and perfect protection measures. Sectoral competent departments and network operators shall coordinate with public security bodies’ annual organization and conduct of cybersecurity supervision and inspections, tournaments, exercises and other such work, and incessantly enhance security protection capabilities and resistance capabilities.
(4) Strengthening cybersecurity incident handling and case investigation When major cybersecurity threats and incidents occur in critical information infrastructure or third-tier and higher networks, sectoral competent departments, network operators and public security bodies shall jointly launch a response. Telecommunications operators and network service providers shall provide technical support and assistance. Network operators shall cooperate with public security bodies in attacking unlawful and criminal online activities; when indications of unlawful or criminal acts, major cybersecurity threats and incidents are discovered, they shall timely report the matter to public security bodies and relevant departments, and provide the necessary assistance.
(5) Strengthening cybersecurity problem and threat correction supervision and management. Public security bodies establish and appoint a supervision and management structure, to be appointed to supervise and manage, or schedule talks with relevant responsible persons where network operators persistently procrastinate and do not correct weak cybersecurity work or major security problems and vulnerabilities, or where relatively large cybersecurity risks exist, major cybersecurity incidents, occur, etc., according to regulatory powers and procedures, together with sectoral competent departments, and to strengthen supervision, inspection and administrative law enforcement, as well as conduct administrative punishment according to laws and regulations. Network operators shall, according to relevant requirements, adopt measures to timely conduct corrections, and eliminate major risks and vulnerabilities. Where major cybersecurity incidents occur, sectoral competent departments shall organize the entire sector to conduct correction and reorganization.
V, Strengthening all guarantees in cybersecurity work
(1) Strengthening organizational leadership. All work units and all departments must give high regard to multi-level cybersecurity protection and critical information infrastructure security protection work, enter it onto the important matters agenda, strengthen comprehensive leadership, planning and design, earnestly research and resolve major problems such as the establishment of cybersecurity bodies, personnel allocation, financial input, security protection measure construction, etc. Sectoral competent departments and network operators must clarify that the main responsible persons in those work units are the first responsible persons for cybersecurity, and determine a leading cadre management to be separately responsible for cybersecurity work, establish dedicated cybersecurity bodies, clarify tasks and divisions of labour, grasping matters level by level, and implementing matters level by level.
(2) Strengthening financial policy guarantees. All work units and all departments must, through existing funding channels, ensure funding input for critical information infrastructure, third-tier and higher networks, etc., to conduct tiered monitoring, risk assessment, encryption use security monitoring, drills and competitions, security construction and reorganization, security protection platform construction, encryption protection system construction, operational maintenance, supervision and inspection, education and training, etc. Critical information infrastructure operators shall ensure sufficient amounts of cybersecurity input, and when making cybersecurity and informatization-related policy decisions, shall have members from the cybersecurity management body participate. Relevant departments must support focus cybersecurity technology industries and projects, support cybersecurity technology research, development, innovation and application, and promote the healthy development of the cybersecurity industry. Public security bodies must, together with relevant departments, organize and implement “Belt-Road” cybersecurity strategies, and support cybersecurity enterprises “marching out”, and share China’s cybersecurity protection experience with relevant countries.
(3) Strengthening testing and evaluation All work units and all departments must further complete and perfect cybersecurity testing and evaluation structures, clarify testing standards, and organize the conduct of testing. Public security bodies will enter cybersecurity work into the comprehensive social management and governance testing and evaluation system, annually organize testing and evaluation to be conducted for all localities’ cybersecurity work, annually chose advance work unit in cybersecurity multi-level protection and critical information infrastructure security protection work, and report the results to Party Committees and governments, and notify cybersecurity and informatization departments.
(4) Strengthening technical breakthroughs. All work units and all departments must fully muster social forces from cybersecurity enterprises, scientific research bodies, experts, etc., to vigorously participate in making core breakthroughs in cybersecurity technology, strengthen cybersecurity coordination and cooperation, interaction and mutual support, joint governance and sharing, and collective defence and collective governance. Public security bodies must, together with relevant departments, strengthen cybersecurity multi-level protection and critical information infrastructure security protection standards formulation work, publish standards and application guidelines, strengthen the dissemination, application and implementation of standards build pilot demonstration bases, and enhance the healthy development of our country’s cybersecurity industries and enterprises.
(5) Strengthening talent training. All work units and all departments must strengthen cybersecurity multi-level protection and critical information infrastructure security protection professional exchanges, and discover and select high-grade, precise and advanced talents through organizing and conducting tournaments, competitions and other such forms, build talent databases, establish and complete talent discovery training, selection and use mechanisms, and provide talent guarantees to do cybersecurity work well.
Following the connection and convergence of information technology and human production and lives, global data have gained the characteristics of explosive growth and massive collection, the big data industry is in a period of brisk development, technological progress and application innovation have accelerated their advance in lockstep, data resources have become national fundamental strategic resources and innovation factors for social production. At present, our country’s telecommunications and Internet sectors are developing rapidly, collecting large amounts of online data, and at the same time as liberating the development potential of the data economy and stimulating the accelerated growth of the data economy, we face severe security risks. This requires that we deeply understand the importance and urgency of online data security, persist in equally stressing security and development, vigorously responding to complex and severe security risks and challenges, and accelerate the construction of a security protection system for online data.
“In safe development, standards go first”, standardization work is an important basis in guaranteeing online data security. In order to implement the requirements of laws and regulations such as the “Cybersecurity Law of the People’s Republic of China”, the “National People’s Congress Standing Committee Decision concerning Strengthening Online Information Protection”, the “Telecommunications and Internet User Personal Information Protection Regulations”, etc., guide online data security standardization work in the telecommunications and Internet sectors, the Ministry of Industry and Information Technology has organized the drafting of the “Guidelines for the Construction of the Online Data Security Standards System” (hereafter simply named “Construction Guidelines”. The “Construction Guidelines” give full rein to the top-level design and fundamental guidance roles of standards, and provides a powerful support for guaranteeing online data security in the telecommunications and Internet sectors, stimulating the rational and orderly flow of online data, and assist the high-quality development of the digital economy. Read the rest of this entry »
MIIT Communications No. (2020)49
All provincial, autonomous regions, municipal, plan-listed city and Xinjiang Production-Construction Corps controlling departments for industry and information technology, and wireless communications management bodies, all provincial, autonomous region and municipal telecommunications management bureaus, China Telecom Group Co. Ltd., China Mobile Telecommunications Group Co. Ltd., China Unicom Telecommunications Group Co. Ltd., China Tower Co. Ltd., China Broadcast Network Co. Ltd.:
In order to deeply implement the spirit of General Secretary Xi Jinping’s important speech concerning promoting the accelerated development of 5G networks, forcefully advance 5G network construction, usage, popularization, technology development and security protection, give full rein to the effects of scale and driving role of new 5G infrastructure, and support high-quality economic development, hereby, related matters are notified as follows:
Determination Rules on Acts of Collecting and Using Personal Information in Violation of Rules and Regulations in Apps
Notice concerning Issuance of the “Determination Rules on Acts of Collecting and Using Personal Information in Violation of Rules and Regulations in Apps”
All provincial, autonomous region, municipal and the Xinjiang Production-Construction Corps cybersecurity and informatization offices, telecommunications management bureaus, public security offices (bureaus), market supervision and management bureaus (offices, committees):
On the basis of the “Announcement concerning a Special Campaign on Collection and Use of Personal Information in Violation of Rules and Regulations in Apps”, in order to provide reference for the determination of acts of collecting and using personal information in violations of rules and regulations in apps, implement laws and regulations such as the “Cybersecurity Law”, etc., the Cyberspace Administration of China, Ministry of Industry and Information Technology, Ministry of Public Security, and State Administration of Market Regulation have jointly formulated the “Determination Rules on Acts of Collecting and Using Personal Information in Violation of Rules and Regulations in Apps”. These are hereby issued to you, please refer to and implement them in integration with supervision, management and law enforcement work realities.
Cyberspace Administration of China Secretariat
Ministry of Industry and Information Technology General Office
Ministry of Public Security General Office
State Administration for Market Regulation General Office
28 November 2019
Determination Rules on Acts of Collecting and Using Personal Information in Violation of Rules and Regulations in Apps
On the basis of the “Announcement concerning a Special Campaign on Collection and Use of Personal Information in Violation of Rules and Regulations in Apps”, in order to provide reference for the determination of acts of collecting and using personal information in violations of rules and regulations in apps, provide guidance for app operators’ self-inspection and self-rectification as well as netizens’ social supervision, and implement laws and regulations such as the “Cybersecurity Law”, these Rules are formulated.
I, The following acts may be determined as “not publishing collection and use norms”
2. When using the app for the first time, users are not prompted to read privacy policies and other such norms on collection and use through a pop-up window and other such clear methods
II, The following acts may be determined as “not indicating the objective, method and scope of collecting and using personal information”
1. Not listing the objective, method and scope of personal information collection and use in the app (including entrusted third parties or embedded third-party code and plug-ins) one by one;
3. When requesting to activate authorization of collectable personal information, or requesting to collect users’ identity card number, bank account number, geographical tracking and other such sensitive personal information, not simultaneously notifying the user about its objective, or having an unclear or difficult to understand objective.
4. Content related to collection and use norms is obscure and difficult to understand, verbose and overly detailed, which is difficult for users to understand, for instance using large amounts of specialist jargon, etc.
III, The following acts may be determined as “collecting and using personal information without users’ consent”
1. Beginning to collect personal information or activating authorizations for collectable information before obtaining users’ consent;
2. After users clearly indicate they do not consent, still collecting personal information or activating up collectable personal information authorizations, or frequently obtaining users’ consent, interfering with users’ regular use;
3. Actually collecting personal information or activating collectable personal information authorizations in excess of the scope of user authorization;
4. Obtaining users’ consent by way of implicit agreement to privacy policies and other non-explicit methods;
5. Altering the status of collectable personal information authorizations they have set up without users’ consent, for instance automatically restoring user-set up authorization to implicit approval status when updating an app;
6. Using users’ personal information and algorithms to direct push delivery information, without providing an option for non-targeted push delivery information;
7. Misleading users through fraudulent, swindling and other such improper methods into consenting to personal information collection or the activation of collectable personal information authorizations, for instance wilfully hoodwinking or covering up the true objective for the collection of users’ personal information;
8. Not providing users with a way and method to revoke consent for personal information collection;
9. Collecting users’ personal information in violation of the announced collection and use norms.
IV, The following acts may be determined as “collecting personal information in violation of the principle of necessity, that is not related to the provided service”
1. Collected categories of personal information or activated collectable personal information authorizations are not related to the existing business functions;
2. Refusing to provide business functions because users do not consent to the collection of unnecessary personal information or the activation of unnecessary authorizations;
3. Requesting the collection of personal information in excess of the scope the user originally consented to when adding new business functions to the app, refusing to provide the original business functions if the user does not agree, except where the newly added business function supersedes the original business function;
4. The frequency of personal information collection exceeds the actual needs of business functions;
5. Obliging he user to consent to personal information collection for only the purpose of improving of service quality, enhancing user experience, targeting push delivery information, researching and developing new products, etc.,
6. Requiring users to consent once to activating multiple collectable personal information authorizations, where use is impossible if users do not consent.
V, The following acts may be determined as “providing personal information to others without consent”
1. Providing personal information directly from the app customer end to third parties both without user content, and without anonymized processing, including providing personal information to third parties through methods such as embedding third-party code or plug-in components at the customer end, etc.;
2. Providing collected personal information to third parties after data is transmitted to the app’s back-end servers both without user content, and without anonymized processing;
3. Even if functions are provided to correct and delete personal information and cancel user accounts, not timely responding to user’s corresponding operations, requiring manual processing, not completing examination and processing within the committed time limits (the committed time limit may not exceed 15 working days, where there is not committed time limit, 15 working days are taken as limit);
4. Where the executing of correction or deletion of personal information, the cancellation of user accounts and other such user operations has been completed, but it is not completed at the app back-end;
5. Not establishing and publishing personal information security complaints and reporting channels, or not accepting and processing matters within the committed time limits (the committed time limit may not exceed 15 working days, where there is not committed time limit, 15 working days are taken as limit).
This suggestion draft is one of the outcomes of the National Social Science Fund Major Project “Important Legislative Questions for Internet Security” (14ZDC021) at Renmin University of China Law School, of which Professor Zhang Xinbao is lead expert, its objective is to provide reference for legislation, its authors are Zhang Xinbao and Ge Xin. On deficiencies in the suggestion draft, the submission of valuable opinions and suggestions is welcomed, to be sent to firstname.lastname@example.org. After further revision and perfection, the suggestion draft and statement of grounds for legislation will be published in the near future by Renmin University of China Press, further attention is respectfully invited. Read the rest of this entry »
Management Rules for Credit Information of Gravely Untrustworthy Subjects in Internet Information Services (Opinion-seeking Draft)
Article 1: In order to stimulate the construction of credit in the Internet information services area, ensure the lawful rights and interests of citizens, legal persons and other organizations, on the basis of the “Cybersecurity Law of the People’s Republic of China”, the “Planning Outline for the Construction of a Social Credit System”, the “State Council Guiding Opinions concerning Establishment and Perfection of Joint Incentive Structures for the Trustworthy and Joint Punishment Structures for the Untrustworthy, and Accelerating the Advance of Social Credit Construction”, the “State Council General Office Guiding Opinions concerning Accelerating the Advance of Social Credit System Construction and Building Novel Management Mechanisms Based on Credit” and the “State Council Notice concerning Authorizing the Cyberspace Administration of China to Take Responsibility for Internet Information Content Management Work”, these Rules are formulated. Read the rest of this entry »
State Council General Office Guiding Opinions concerning Accelerating the Advance of Social Credit System Construction and Building Credit-Based Novel Supervision and Management Mechanisms
GBF No. (2019)35
All provincial, autonomous region and municipal People’s Governments, all State Council Ministries and Commissions, all directly subordinate bodies:
In order to strengthen the construction of the social credit system, deeply advance the “release, management and service” reform, further give rein to the fundamental role of credit in innovating supervision and management mechanisms, raising supervision and management capacities and levels, even better incite the vigour of market subjects, and promote high-quality development, with the agreement of the State Council, the following Opinions are hereby put forward.
I, General requirements.
With Xi Jinping Thought on Socialism with Chinese characteristics for a new era as guidance, deeply implement the spirit of the 19th Party Committee and its 2nd and 3rd Plenums, according to the basic principles of acting according to laws and regulations, reform and innovation, coordinated and joint governance, with strengthening credit supervision and management as rallying points, innovate supervision and management concepts, supervision and management structures, and supervision and management methods, establish and complete novel supervision and management methods running throughout the whole lifecycle of market subjects, connecting supervision and management links ex ante, ad interim and ex post, incessantly enhance supervision and management capabilities and levels, further standardize market order, optimize the commercial environment, and promote high-quality development.
II, Innovating credit supervision and management in the ex-ante link
(1) Establishing and completing credit commitment structures. When handling administrative licencing affairs using credit commitment structures, where applicants’ commitments conform to approval conditions and they have submitted the relevant materials, this shall be handled immediately. Where applicants’ credit situation is relatively good, and a part of the application materials is incomplete but they commit in writing to provide this within the provided time period, they shall be accepted with priority, and the handling process is to be accelerated. The circumstances of honouring written commitments will be entered into credit records, to act as an important basis for ad interim and ex post supervision and management, applicants not honouring them will be subject to punishment in view of the circumstances. We must accelerate combing through administrative licensing items amenable to the introduction of credit commitments, formulate credit commitment letters with standardized templates, and rely on all levels’ credit portal websites to publish them. Market subjects are encouraged to actively issue credit commitments to society. Sectoral associations and chambers of commerce are supported in the establishment and completion of intra-sector credit commitment structures, strengthening sectoral self-discipline. (All localities and all departments are respectively responsible according to their duties)
(2) Exploring the introduction of business people’s pre-access sincerity education. Fully utilized all levels’ and all categories’ government service windows, to broadly launch education on legal compliance and sincerity among market subjects. When handling work related to registration, examination and approval, filing, etc. for market subjects, timely introduce standardized, regularized and convenient legal knowledge and credit knowledge education, raising business people’s consciousness on doing business according to the law and sincerely. The launch of credit education must not be fee-paying, and must also not be a necessary condition for market access. (All localities and all departments are respectively responsible according to their duties)
(3) Vigorously expand credit reporting applications. All kinds of market subjects are encouraged to more broadly and actively use credit reports in their production and commercial activities. In processes such as government procurement, tendering and bidding, administrative examination and approval, market access, credential verification, etc., fully give rein to the role of credit reports issues by public credit service bodies and third-party credit service bodies. Explore the establishment of nationwide uniform credit report standards, promote cross-regional mutual recognition of credit report results. (NDRC, PBoC take the lead, all localities and all departments are respectively responsible according to their duties)
III, Strengthening credit supervision and management in the ad interim segment
(4) Comprehensively establish market subject credit records. Establish credit information collection catalogues on the basis of lists of powers and responsibilities, timely, accurately and comprehensively record market subjects’ credit activities in the process of handing registration, qualification verification, daily supervision and management, public service, etc., especially file and record untrustworthiness records, ensure that these can be consulted, verified and traced. ((All localities and all departments are respectively responsible according to their duties). Perfect uniform social credit code structures for legal persons and non-legal person organizations, use the uniform social credit code as a marker to integrate and shape integrated market subject credit records, and publish these according to laws and regulations through channels such as the “Credit China” website, he national enterprise credit information publication system or the China governmental web, as well as other related portal websites. Complete the 12315 market supervision and management complaint reporting hotline and informatized platform integration work, forcefully launch consumer complaints publication, stimulate businesspeople to implement their leading responsibility for consumer rights defence. (NDRC takes the lead, all departments are respectively responsible according to their duties).
(5) Establishing and completing voluntary credit information registration mechanisms. Encourage market subjects to voluntarily register credit information on qualifications and licences, market operations, contract fulfilment, social welfare, etc. on the “Credit China” website or other channels, to make public credit commitments concerning the veracity of the information, authorize the website to integrate, share and apply corresponding information. Verified voluntarily registered information may be an important basis to conduct credit evaluation and generate credit reports. (NDRC takes the lead, all departments are respectively responsible according to their duties.
(6) Deeply conducting comprehensive credit evaluation. The nationwide credit information sharing platforms must strengthen coordination and cooperation with relevant departments, integrate all kinds of credit information according to laws and regulations, conduct full-coverage, standardized, and public interest-type comprehensive public credit evaluation of market subjects, regularly report evaluation results to corresponding government department, financial bodies, sectoral associations and chambers of commerce for reference and use, and publish them to society according to relevant regulations. Promote relevant departments’ use of comprehensive public credit evaluation results, integrate departmental and sectoral management data, establish sectoral credit evaluation models, and provide ever more accurate bases for credit supervision and management. (NDRC takes the lead, all departments are respectively responsible according to their duties)
(7) Forcefully advancing tiered and categorized credit supervision and management. Divide supervision and management across tiers and categories on the basis of fully grasping credit information, and comprehensively deliberating the situation of credit, and on the basis of comprehensive public credit evaluation results and sectoral credit evaluation results, etc., and adopt differentiated supervision and management measures based on the height of the credit tier. “Double random and one public” supervision and management must be integrated with credit tiers, the proportion and frequency of spot checks may be reasonably lowered for market subjects with relatively good credit and relatively low risk, reducing influence to their regular production and operations; for market subjects with ordinary credit risks, spot checks are conducted with conventional proportions and frequencies; for law-breaking, untrustworthy, and relatively high-risk market subjects the proportion and frequency of spot checks will be appropriately increased, implementing strict management and punishment according to laws and regulations. (All localities and all departments are respectively responsible according to their duties)
IV, Perfecting credit supervision and management in the ex-post segment
(8) Completing determination mechanisms for the counterparts for joint punishment for trust-breaking. Relevant departments will establish and complete name list systems for the counterparts of joint punishment for trustworthiness according to laws and regulations, on the basis of untrustworthiness records obtained and determined during the ex ante and interim supervision and management segments. Market subjects with unlawful and untrustworthy acts of a malicious nature, with grave circumstances and relatively large social harm will be listed on the name list for joint punishment counterparts for untrustworthy acts according to procedure and on the basis of corresponding judicial verdicts, administrative punishments, administrative coercive measures, etc. Accelerate the perfection of relevant management rules, clarify determination bases, standards, procedures, dissent appeals and withdrawal mechanisms. For the formulation of management rules, the opinions from the social public must be fully solicited, and published standards and their concrete determination procedures will be made published to society in an appropriate manner. Relevant departments will be supported to establish name list systems for focus attention targets on the basis of requirement, for market subjects where untrustworthy acts exist but the degree of gravity has not reached the determination standard for joint punishment of untrustworthiness, it is permitted to implement strict supervision measures corresponding to the degree of their untrustworthiness. (All departments are respectively responsible according to their duties)
(9) Supervising rectification of untrustworthy market subjects within a limited time. Untrustworthy market subjects shall earnestly rectify matters within the provided time limits; where the rectification is insufficient, the determining department will initiate procedures for prompting talks or warning talks according to laws and regulations, according to the principle of “who determines, has the talk”, and supervise untrustworthy market subjects’ fulfilment of related duties and deletion of the harmful influence. Talk records are included into the credit record of the untrustworthy market subject, and are entered into the national credit information sharing platform after uniform collection. Forcefully advance special campaigns on untrustworthiness issues in focus areas, and adopt powerful and effective measures to accelerate the progress of rectification. (All departments are respectively responsible according to their duties)
(10) Deeply conducting joint punishment for untrustworthiness. Accelerate the construction of cross-regional, cross-sectoral, and cross-area joint punishment mechanisms for untrustworthiness, and resolve the problem that untrustworthy acts emerge repeatedly, or emerge in other areas at the roots. Establish joint punishment measure lists according to laws and regulations, dynamically renew them and publish them to society, and create a large structure for joint punishment for untrustworthiness with multi-barrelled roles for administrative, market and sectoral punishment measures, and broad participation from social forces. Focus on implementing punishment measures for untrustworthiness with great punitive strength and good supervision and management effects, including constraining targets of joint punishment for untrustworthiness according to laws and regulations from issuing shares, tendering and bidding, applying for funding projects from the finance administration, enjoying fiscal preferences and other such administrative punishment measures, restrict them from obtaining credit lines, traveling on aircraft, traveling on high-grade trains and seats and other such market punishment measures, as well as reporting for criticism, public denunciation and other such administrative punishment measures. (NDRC takes the lead, all localities and all departments are respectively responsible according to their responsibilities)
(11) Determinedly implementing market and sector ban mechanisms according to laws and regulations. Implement strict supervision and management, and strengthen punishment with the focus on food and drug products, ecology and the environment, engineering quality, safe production, care for the elderly and children, urban operational security and other such areas directly connected with the security of the popular masses’ lives and assets. Firmly implement market and sectoral ban measures within a certain time period according to laws and regulations, even up to permanent expulsion from markets, against market subjects and their relevant responsible persons who refuse to implement a judicial verdict or an administrative punishment decision, do not improve after repeated violations, resulting in major losses. (NDRC takes the lead, all localities and all departments are respectively responsible according to their duties)
(12) Lawfully investigate liability for law-breaking and untrustworthiness. Establish and complete liability investigation mechanisms, impose untrustworthiness punishment against the legal representative or main responsible persons and actual controlling persons of market subjects listed on the joint punishment target list for untrustworthiness according to laws and regulations, and enter corresponding untrustworthy act on their personal credit record. Where unlawful or untrustworthy conduct occurs in organize undertaking work units or State-owned enterprises, it must be reported to the higher-level competent work unit and auditing department; where unlawful or trust-breaking conduct occurs among work personnel, they must be reported to their work unit and the related discipline inspection, supervision, organization and personnel departments. (All localities and all departments are respectively responsible according to their duties)
(13) Exploring the establishment of credit recovery mechanisms. Where untrustworthy market subjects correct the untrustworthy act and eliminate harmful influence within the provided time limit, they may conduct credit recovery through methods such as issuing credit commitments, completing credit rectification, passing credit inspections, accepting specialized training, submitting credit reports, participating in public interest and charity activities, etc. After recovery is completed, all localities and all departments must timely cease the publication of their untrustworthiness reports according to procedure, and terminate the implementation of joint punishment measures. Accelerate the establishment and perfection of mechanisms for coordination and joint action, handling all affairs through one network, and provide high-efficiency and convenient credit recovery services to untrustworthy market subjects. Third-party credit service bodies meeting conditions are encouraged to provide credit reports, credit management consulting and other such services. (NDRC takes the lead, all localities and all departments are respectively responsible according to their duties)
V, Strengthening support and safeguards for credit supervision and management
(14) Striving to enhance credit supervision and management informatization construction levels. Give full rein to the information collection and sharing role of the nationwide credit information sharing platform and the national “Internet Plus Supervision and Management” system, ensure that government departments’ credit information “is fully collected where it shall be collected”, enhance the interconnection and interaction of local credit information platforms and sectoral credit information systems, create smooth government and enterprise data circulation mechanisms, create “one network” completely covering credit information of all localities, all departments and all kinds of market subjects. Rely on the national credit information sharing platform and the national “Internet Plus Supervision and Management” system to share basic market subject information, law enforcement supervision, management and punishment information, untrustworthiness joint punishment information etc. with related departmental operations systems according to requirement, add applications in the process of credit supervision and management and other such processes, support the creation of a credit supervision and management coordination mechanism with synchronized data, uniform measures and consistent standards. (NDRC and State Council General Office take the lead, all localities and all departments are respectively responsible according to their duties)
(15) Forcefully advancing credit supervision and management information openness and publication. On the basis of integrated publication of administrative licensing and administrative punishment information, entrust the “Credit China” website, the Chinese government network and other channels with further researching and promoting the open uploading of information on administrative obligations, administrative affirmations, administrative collection, administrative fees, administrative rulings, administrative compensation, administrative rewards, administrative supervision and inspection, and other such administrative acts within seven working days, promote the publication of information in judicial verdicts and law enforcement activities related to untrustworthy persons subject to enforcement and untrustworthy persons making false complaints of whom the information should be published, ensuring that “what shall be published, is fully published”. (All localities and all departments are respectively responsible according to their duties)
(16) Fully giving rein to the supporting role of “Internet Plus” and big data in credit supervision and management. Rely on the national “Internet Plus Supervision and Management” system and other such systems to effectively integrate public credit information, market credit information, complaints reporting information and related Internet and third-party information, fully use big data, artificial and other such new-generation information technologies to realize that credit supervision and management data can be compared, processes can be traced, and issues can be monitored. All localities and all departments are encouraged to, in integration with reality, cooperate with big data bodies according to laws and regulations to exploit credit information, grasp market subjects’ business situations and the characteristics of their laws in a timely and dynamic manner. Fully use the national “Internet Plus Supervision and Management” system and other such systems to establish early risk assessment and early warning mechanisms, to discover and prevent symptomatic, cross-sectoral and cross-regional risks early. Use big data to actively discover and distinguish clues for violations of laws and regulations, effectively prevent acts violating laws and regulations harming the public interests and the security of the masses’ lives and assets. It is encouraged to enhance law enforcement supervision and management efficiency through the Internet of Things, the Internet of Vision and other such non-contact supervision and management measures to enhance the efficiency of law enforcement, supervision and management, realize the standardization, accuratization and smartification of supervision and management, reduce human factors, realize fair supervision and management, stop problems such as wilful inspections, multi-headed supervision and inspection, etc., realize “entering the door once, inspecting multiple matters”, and reduce disturbance to supervision and management targets. (State Council General Office, NDRC, State Administration of Market Regulation take the lead, all departments are respectively responsible according to their duties.
(17) Realistically strengthening the protection of credit information security and market subjects’ rights and interests. Strictly investigate and prosecute acts where credit information is leaked or distorted in violation of regulations, or credit information is used in pursuit of private gain, etc. Strengthen the construction of basic credit information security infrastructure and security protection capabilities. Establish and complete credit information objection and complaint structures, information providing and collecting work units must as quickly as possible examine and verify information to which market subjects have raised an objection and feed back the results, information verified as containing errors must be timely corrected or deleted. Where market subjects’ lawful rights and interests were harmed after they were erroneously assigned to the untrustworthiness joint punishment target list, or untrustworthiness joint measures were erroneously adopted, relevant departments and work units must vigorously adopt measures to eliminate the harmful influence. (All localities and al departments are responsible on the basis of their duties)
(18) Vigorously guiding sectoral organizations and credit service bodies to coordinate supervision and management. Relevant department-authorized sectoral associations and chambers of commerce are supported to assist in the conduct of sectoral credit construction and credit supervision and management, sectoral associations and chambers of commerce are encouraged to establish member credit records, conduct credit commitments, credit training, sincerity propaganda, sincerity advocacy etc., make sincerity into an important component for sectoral rules and sectoral conventions, and guide their sectors in strengthening awareness about doing business lawfully and sincerely. Promote the development of information services for credit inquiry, credit grading, credit insurance, credit guarantees, contract fulfilment guarantees, credit management consulting and training, etc., and realistically let third-party credit service bodies play a specialized role in aspects such as credit information collection, processing, use, etc. Relevant departments are encouraged to launch cooperation’s with third-party credit service bodies in areas such as credit record integration, credit information sharing, credit big data analysis, credit risk early warning, examination and verification of cases of untrustworthiness, tracing and monitoring of untrustworthy activities, etc. (NDRC, Ministry of Civil Affairs, People’s Bank of China are respectively responsible according to their duties)
VI, Strengthening organization and implementation of credit supervision and management
(19) Strengthening organizational leadership. All localities and all departments must make building credit-based novel supervision and management mechanisms into an important measure in deeply advancing the “release, manage, serve” reform, put it in an ever more prominent position, strengthen organizational leadership, detail divisions of work and responsibilities, and promote implementation in a forceful, orderly and effective manner. Perfect supplementary structures to credit supervision and management, and strengthen links with other elements of “release, manage, serve” reform. Departments responsible for market supervision and management and sectoral supervision and management must realistically bear their dominant responsibility in sectoral credit construction and credit supervision and management, fully give rein to the roles of sectoral organizations and third-party credit service bodies, create beneficial conditions for public supervision, integrate and create joint forces for credit supervision and management with joint participation from all of society. (NDRCD takes the lead, all departments and all localities are respectively responsible according to their duties)
(20) Launching trials and demonstrations. Organize and launch credit construction and credit supervision and management trials and demonstrations revolving around credit commitments, credit recovery, untrustworthiness joint punishment, credit big data exploitation and use and other such focus work. On the basis of exploration and innovation in all localities and all departments, timely summarize, abstract and exchange good methods and good experiences in launching credit construction and credit supervision and management, and reproduce and broaden them on an ever greater scale (NDRC takes the lead, all localities and all departments are respectively responsible according to their duties)
(21) Accelerating the establishment of rules and structures. Promote the formulation of social credit system construction-related laws, accelerate the research and promulgation of public credit information management regulations, unified social credit code management rules and other such regulations. Establish and complete nationwide uniform credit supervision and management norms and standards, timely publish related local regulations, government rules and normative documents, and upgrade methods effective in credit supervision and management practice into structures and norms. Grasp the formulation of national standards urgently needed in credit supervision and management. (NDRC, Ministry of Justice take the lead, all localities and all departments are respectively responsible according to their duties)
(22) Conducting propaganda and explanation. All localities and all departments must, through all kinds of channels and methods, conduct policy propaganda and explanation work in a thorough and detailed manner for market subjects, to let businesspeople fully understand and vigorously cooperate with credit-based novel supervision and management measures. Strengthen guidance and training for grass-roots and first-line supervision and management personnel. Organize news media to report broadly, vigorously propagate credit supervision and management measures and their results, and create a benign social atmosphere. (NDRC takes the lead, all localities and all departments are respectively responsible according to their duties)
State Council General Office
9 July 2019
Ministry of Public Security of the People’s Republic of China Decree
The “Regulations on Internet Security Supervision and Inspection by Public Security Bodies” were passed at the Minister’s business meeting of the Ministry of Public Security on 5 September 2018, are hereby promulgated, and take effect on 1 November 2018.
Minister: Zhao Kezhi
15 September 2018
Regulations on Internet Security Supervision and Inspection by Public Security Bodies
Chapter I: General provisions
Article 1: These Regulations are formulated in order to standardize public security bodies’ Internet security supervision and inspection work, prevent online law-breaking and crime, safeguard cybersecurity, protect the lawful rights and interests of citizens, legal persons and other organizations, on the basis of the “People’s Police Law of the People’s Republic of China”, the “Cybersecurity Law of the People’s Republic of China” and other such laws and administrative regulations.
Article 2: These Regulations apply to public security bodies conducting security supervision and inspection of Internet service providers’ and network-using work units’ fulfilment of cybersecurity duties provided in laws and administrative regulations.
Article 3: Internet security supervision and inspection work is conducted by county-level or higher local People’s Government public security body cybersecurity protection departments.
Higher-level public security bodies shall implement guidance and supervision of lower levels’ public security bodies’ conduct of Internet security supervision and inspection work.
Article 4: Public security bodies conducting Internet security supervision and inspection shall abide by the policies of scientific management, ensuring and stimulating development, strictly abide by statutory powers and procedures, incessantly improve law enforcement methods, and comprehensively implement law enforcement responsibilities.
Article 5: Public security bodies and their work personnel shall strictly preserve the secrecy of personal information and privacy, commercial secrets and State secrets they learn in the process of fulfilling Internet security supervision and inspection duties and responsibilities, they may not leak this, sell it or illegally provide it to others.
Public security bodies and their work personnel can only use information they learn in the process of fulfilling Internet security supervision and inspection duties as required for maintaining cybersecurity, and may not use it for other purposes.
Article 6: Public security bodies shall timely notify relevant controlling departments and work units about cybersecurity risks they discover in the process of Internet security supervision and inspection work, which may harm national security, public security or social order.
Article 7: Public security bodies shall establish and implement rules for Internet security supervision and inspection work, and consciously accept supervision by inspection counterparts and the popular masses.
Chapter II: Supervision and inspection counterparts and content.
Article 8: Internet security supervision and inspection will be conducted by public security bodies of the locality of Internet service providers’ network service operations bodies and network using work units’ network management bodies. Where an Internet service provider is an individual, it may be implemented by the public security body of their regular place of residence.
Article 9: Public security bodies shall, on the basis of cybersecurity protection requirements and the concrete circumstances of cybersecurity risks and vulnerabilities, conduct supervision and inspection of the following Internet service providers and network-using work units.
(1) Those providing Internet access, Internet data centre, content distribution and domain name services;
(2) Those providing Internet information services;
(3) Those providing public network access services;
(4) Those providing other Internet services.
Focus supervision and inspection shall be conducted of those who have not conducted the services provided in the previous Paragraph for a full year, those where a cybersecurity incident, breach of law or crime occurred within two years, or those who have been subject to administrative punishment by a public security body for not fulfilling statutory cybersecurity duties.
Article 10: Public security bodies shall, on the basis of the actual circumstances of Internet service providers’ and network-using work units fulfilling their statutory cybersecurity duties, and according to relevant State regulations and standards, conduct supervision and inspection of the following content:
(1) Whether or not they have conducted network work unit filing formalities, and have reported the access work unit, basic user information and changes therein;
(2) Whether or not they have formulated and implemented cybersecurity management rules and operating rules, and appointed a person responsible for cybersecurity;
(3) Whether or not they have adopted technical measures to record and preserve user registration information and network use record information according to the law;
(4) Whether or not they have adopted technical measures to defend against computer viruses, cyberattacks, cyber intrusions, etc.;
(5) Whether or not they have adopted corresponding prevention measures against the publication or transmission of information prohibited in laws and administrative regulations according to the law in public information services;
(6) Whether or not they have provided technical support and assistance to public security bodies lawfully maintaining cybersecurity, preventing and investigating terror activities, or investigating crimes according to statutory provisions;
(7) Whether or not they have fulfilled cybersecurity multi-level protection duties as provided in laws and administrative regulations.
Article 11: Apart from the content listed in Article 10 of these Regulations, public security bodies shall also conduct supervision and inspection of the following content, on the basis of the category of provided Internet services:
(1) Where Internet access services are provided, supervising and inspecting whether they have recorded and preserved network address, allocation and use details;
(2) Where Internet data centre services are provided, supervising and inspecting whether they have recorded user information of the host entrustment, host rental and virtual space rental they provide;
(3) Where Internet domain name services are provided, supervising and inspecting whether they have recorded network domain name application and modification information, and whether or not they have adopted measures to deal with unlawful domain names according to the law.
(4) Where Internet information services are provided, supervising and inspecting whether they have adopted user-disseminated information management measures according to the law, whether or not they have adopted measures to deal with already published or transmitted information of which the dissemination or transmission is prohibited by laws and administrative regulations, and maintained related records;
(5) Where Internet content distribution services are provided, supervising and inspecting whether or not they have recorded circumstances concerning content distribution network and content source network links;
(6) Where Internet public access services are provided, supervising and inspecting whether or not they have adopted technical network and information security protection measures conform to national standards.
Article 12: During periods of national major cybersecurity defence tasks, public security bodies may conduct targeted security supervision and inspection of the following content of Internet service providers and network-using work units related to national major cybersecurity defence tasks:
(1) Whether or not they have formulated work plans required for major national cybersecurity defence tasks, clarified cybersecurity duties and work divisions, and appointed a management person for cybersecurity;
(2) Whether or not they have organized and conducted cybersecurity risk assessments, and adopted corresponding risk control measures to remedy cybersecurity leaks and vulnerabilities;
(3) Whether or not they have formulated cybersecurity emergency response plans, organized and conducted emergency response exercises, and whether or not emergency response-related equipment is complete and effective.
(4) Whether or not they have adopted other cybersecurity protection tasks required for major cybersecurity protection tasks according to the law;
(5) Whether or not they have reported cybersecurity protection measures and implementation circumstances to public security bodies according to requirement.
Internet security supervision and inspection with preventing terror attacks as its major objective will be implemented according to the content provided in the previous Paragraph.
Chapter III: Supervision and inspection procedures
Article 13: Public security bureaus conducting Internet security supervision and inspection may adopt on-site supervision and inspection or remote monitoring methods to do so.
Article 14: When public security bodies conduct on-site Internet security supervision and inspection, the number of People’s Police may not be less than 2, and they shall produce their People’s Police card and county-level or higher local People’s Government public security body-issued supervision and inspection notification letter.
Article 15: Public security bodies conducting on-site Internet security supervision and inspection may adopt the following measures on the basis of requirement:
(1) Entering business premises, computer rooms, work premises;
(2) Requiring the supervision and inspection counterpart’s responsible person or cybersecurity management personnel to explain supervision and inspection matters;
(3) Consulting and reproducing information related to Internet security supervision and inspection;
(4) Checking the operational state of technical network and information security protection measures.
Article 16: Public security bodies may conduct remote monitoring on whether or not cybersecurity leaks exist with Internet service providers and network-using work units.
Public security bodies conducting remote monitoring shall notify the supervision and inspection counterpart in advance about the inspection time, inspection cope and other such matters, or publish the related inspection matters, they may not interfere with or destroy the regular operations of the supervision and inspection counterpart’s networks.
Article 17: Public security bodies conducting on-site supervision and inspection or remote monitoring may entrust cybersecurity service bodies having corresponding technical capabilities with providing technical support.
Cybersecurity service bodies and their work personnel shall strictly preserve the secrecy of personal information and privacy, commercial secrets and State secrets they learn in the process of fulfilling Internet security supervision and inspection duties and responsibilities, they may not leak this, sell it or illegally provide it to others.
Public security bodies shall strictly supervise cybersecurity service bodies’ implementation of cybersecurity management and secrecy protection responsibilities.
Article 18: Public security bodies conducting on-site supervision and inspection shall draft supervision and inspection records, and have them signed by the People’s Police conducting supervision and inspection and the responsible person or cybersecurity management personnel from the supervision and inspection counterpart. Where the responsible person or cybersecurity management personnel from the supervision and inspection counterpart object to the supervision and inspection record, they shall be allowed to explain the matter; where they refuse to sign, People’s Police shall indicate this on the supervision and inspection record.
Public security bodies conducting remote monitoring shall draft supervision and inspection records, and have the supervision and inspection record signed by two or more People’s Police conducting the supervision and inspection.
Where cybersecurity service bodies are entrusted with providing technical support, the technical support personnel shall sign the supervision and inspection record together.
Article 19: Public security bodies discovering that cybersecurity risks or vulnerabilities exist in Internet service providers and network-using work unit in the process of Internet security supervision and inspection, shall urge and guide them to adopt measures to eliminate the risks or vulnerabilities, and indicate this in the supervision and inspection records; where they discover unlawful acts, but circumstances are light or no results have been created, they shall order them to correct the matter within a limited time.
Where the supervision and inspection counterpart believes they have completed correction before the end of the time limit, they may submit a re-inspection application in writing to the public security body.
Public security bodies shall, within three working days after the time limit ends or after receiving an earlier re-inspection application from the supervision and inspection counterpart, conduct a re-inspection of the corrected situation, and feed back the re-inspection results within three working days after the re-inspection concludes.
Article 12: All kinds of material collected in the process of inspection, or all kinds of produced documents and other materials, shall be stored in files according to regulations.
Chapter IV: Legal liability
Article 21: Where public security bodies discover Internet service providers or network-using work units committed the following unlawful acts in the process of Internet security supervision and inspection, they shall impose administrative punishment according to the law:
(1) Those not formulating or implementing cybersecurity management rules and operating rules, or not appointing a responsible person for cybersecurity, will be punished according to Article 59 Paragraph I of the “Cybersecurity Law of the People’s Republic of China”;
(2) Those not adopting technical measures to defend against computer viruses, cyberattacks, cyber intrusions and other such acts harming cybersecurity, will be punished according to the provisions of Article 59 Paragraph I of the “Cybersecurity Law of the People’s Republic of China”;
(3) Those not adopting measures to record and preserve user registration information and web access daily record information, will be punished according to the provisions of Article 59 Paragraph I of the “Cybersecurity Law of the People’s Republic of China”;
(4) Those not requiring users to provide real identity information according to requirements in the process of providing Internet information dissemination, instant communication and other such services, or who provide related services to users not providing real identity information, will be punished according to the provisions of Article 61 of the “Cybersecurity Law of the People’s Republic of China”;
(5) Those who do not adopt measures to cease transmission and delete information of which the dissemination and transmission is prohibited by laws and administrative regulations according to the law or according to public security bodies’ requirements, and preserve relevant records, will be punished according to the provisions of Article 68 or Article 69 Paragraph I of the “Cybersecurity Law of the People’s Republic of China”;
(6) Those refusing to provide technical support and assistance to public security bodies maintaining cybersecurity and investigating criminal activities according to the law, will be punished according to the provisions of Article 69 Paragraph III of the “Cybersecurity Law of the People’s Republic of China”.
Where the acts in the preceding items 4 to 6 violate the “Anti-Terrorism Law of the People’s Republic of China”, they will be punished according to the provisions of Article 84 or Article 86 Paragraph I of the “Anti-Terrorism Law of the People’s Republic of China”.
Article 22: Where public security bodies, in the process of Internet security supervision and inspection, discover Internet service providers and network-using work units steal or obtain personal information in an illegal manner, illegally sell or illegally provide it to others, but it does not constitute a crime, they will be punished according to the provisions of Article 64 Paragraph II of the “Cybersecurity Law of the People’s Republic of China”.
Article 23: Where public security bodies, in the process of Internet security supervision and inspection, discover Internet service providers and network-using work units have installed malicious programmes in the Internet services they provide, they will be punished according to the provisions of Article 60 Paragraph I of the “Cybersecurity Law of the People’s Republic of China”.
Article 24: Where Internet service providers and network-using work units refuse or impede public security bodies’ conduct of Internet security supervision and inspection, they will be punished according to the provisions of Article 69 Paragraph II of the “Cybersecurity Law of the People’s Republic of China”; where they refuse to cooperate with anti-terrorism work, they will be punished according to the provisions of Article 91 or Article 92 of the “Anti-Terrorism Law of the People’s Republic of China.
Article 25: Where cybersecurity service bodies and their work personnel entrusted with providing technical support engage in illegal intrusion into the supervision and inspection counterpart’s networks, interfere with the regular functioning of the supervision and inspection counterpart’s networks, or steal online data and other such activities harming cybersecurity, they will be punished according to the provisions of Article 63 of the “Cybersecurity Law of the People’s Republic of China”; where they steal personal information they have obtained in the process of their work or obtain it in an illegal manner, illegally sell or illegally provide it to others, they will be punished according to the provisions of Article 64 Paragraph II of the “Cybersecurity Law of the People’s Republic of China”, where it constitutes a crime, criminal liability will be prosecuted according to the law.
Where bodies and their work personnel as provided in the previous Paragraph infringe the commercial secrets of the supervision and inspection counterpart, constituting a crime, criminal liability will be prosecuted according to the law.
Article 26: Where public security bodies and their work personnel, in the process of Internet security supervision and inspection work, are derelict in their duties, abuse their powers, or engage in favouritism, the directly responsible person in charge and other directly responsible personnel will be punished according to the law; where it constitutes a crime, criminal liability will be prosecuted according to the law.
Article 27: Where Internet service providers and network-using work units violate these Regulations, constituting a violation of public security management, they will be subject to public order management punishment; where it constitutes a crime, criminal liability will be prosecuted according to the law.
Chapter V: Supplementary provisions
Article 28: Supervision and inspection of commercial Internet access service venues will be implementing according to the relevant provisions of the “Commercial Internet Access Service Venue Management Regulations”.
Article 29: These Regulations take effect on 1 November 2018.
Following the rapid development of the mobile Internet and big data, the scale and impact of the disclosure of personal information of our country’s netizens has become ever larger, gravely infringing netizens’ rights and interests, harming the public interest, and attracting a high degree of attention from competent government departments as well as the broad attention of all walks of society. In order to protect netizens’ personal information security, safeguard the rights and interests of netizens, guide Internet enterprises to collect, store and use personal information in a standardized manner, stimulate the implementation of related laws and regulations, promote the healthy and sustainable development of the Internet sector, the Internet Society of China proposes the following Proposal to the nationwide Internet circles:
I, Strictly abide by all laws and regulations formulated by national and sectoral competent departments, as well as the sectoral self-discipline conventions issued by the Internet Society of China, and cooperate with relevant government departments’ lawful actions to attack the online disclosure of personal information.
II, Strengthen sectoral self-discipline, shoulder corporate social responsibility, strengthen examination, verification and management of interactive platforms such as websites, forums, microblogs, instant messaging, e-commerce, etc., timely discover and clean up online disclosure of personal information, do not provide communication channels for information disclosure, and protect netizens’ lawful rights and interests.
III, Complete supervision and reporting mechanisms, vigorously respond to netizens’ complaints in the area of personal information protection, timely feed back handling outcomes to netizens, earnestly correct problems reflected by the public, increase online service quality, and create an online environment of security and sincerity.
IV, Strengthen professional training for employees, raise employees’ understanding of personal information protection, require employees to earnestly implement legal responsibilities, abide by legal provisions, and implement the requirements concerning personal information protection in laws and regulations.
V, Strengthen cybersecurity protection capabilities, and prevent that databases and user information is stolen. If cybersecurity incidents such as disclosure of user information are discovered, timely report them to public security bodies and relevant government departments, adopt effective measures to plug cybersecurity vulnerabilities, and protect data and information security.
VI, Strengthen propaganda, raise netizens’ capability to identify and judge phishing, fraud and other such online violations and harmful information, strengthen netizens’ understanding and usage levels of online smart terminals, strengthen personal information protection awareness, and prevent personal information disclosure.
Internet Society of China
14 September 2018.
Appendix: small measures to prevent personal information disclosure
1, Do not register at websites with unclear sources, cautiously use mobile phone number registration.
2, Do not scan QR codes from an unclear origin, do not install software from an unclear origin.
3, Information on replaced electronic products must be deleted thoroughly, to prevent law-breakers from recovering data.
4, Processing paper forms with personal information requires caution, and privacy information must be erased.
5, Avoid disclosing excessive personal information on social software, to prevent its use by lawbreakers.
6, Cautiously use free WiFi in public venues, to prevent disclosure of user names and passwords.
7, Do not click on links in text messages and mails, in order to avoid “phishing”.
8, The same account name and password group must not be used on different pieces of software, in order to avoid the creation of grave harm.
In the wake of the recent upgrade of the Central Leading Group for Cybersecurity and Informatization to a fully-fledged Commission, a national Work Conference on Cybersecurity and Informatization work took place in Beijing on 20 and 21 April. Xi Jinping gave a speech outlining adjusted priorities after the 19th Party Congress. The full text of the speech has not (yet) been made public. This is a translation of the official Xinhua report. Analysis will be published on the DigiChina platform.
Xi Jinping Stresses at the Cybersecurity and Informatization Work Conference to Keenly Grasp the Historical Opportunity in Informatization Development, and Move Forward the Construction of a Cyber Power through Indigenous Innovation
Li Keqiang Chairs, Li Zhanshu, Wang Yang, Wang Huning, Zhao Leji and Han Zheng Attend
Xinhua, 21 April, Beijing (Journalists Zhang Xiaosong, Zhu Jichai). The National Cybersecurity and Informatization Work Conference was convened on the 20th and 21st in Beijing. CCP Central Committee General Secretary, State President, Chair of the Central Military Commission and Chair of the Central Commission for Cybersecurity and Informatization Xi Jinping attended the Conference and gave an important speech. He stressed that informatization has brought extremely rare opportunities to the Chinese nation. We must acutely grasp the historical opportunity of informatization development, strengthen online positive propaganda, safeguard cybersecurity, promote breakthroughs in core technologies in the informatization area, give rein to the guiding role of informatization in economic development, strengthen civil-military convergence in the cybersecurity and informatization area, actively participate in international cyberspace governance processes, move forward the construction of a cyber power through indigenous innovation, and make new contributions to determine victory in comprehensively constructing a moderately prosperous society, seize new grand victories for Socialism with Chinese Characteristics in a new era, and realize the Chinese Dream of the Great Rejuvenation of the Chinese Nation. Read the rest of this entry »
Chapter I: General Principles
Article 1: In order to strengthen and standardize Internet security supervision and inspection work by public security bodies, prevent online law-breaking and crime, safeguard cybersecurity, protect the lawful rights and interests of citizens, legal persons and other organizations, on the basis of the “People’s Police Law of the People’s Republic of China”, the “Cybersecurity Law of the People’s Republic of China” and other such relevant laws and administrative regulations, these Regulations are formulated. Read the rest of this entry »
Report concerning the Inspection of the Implementation of the “Cybersecurity Law of the People’s Republic of China” and the “National People’s Congress Standing Committee Decisions concerning strengthening Online Information Protection”
Presented at the 31st Meeting of the 12th National People’s Congress Standing Committee on 24 December 2017
Cybersecurity affects the long-term governance of the Party, affects a long period of peace and order for the country, and affects economic and social development as well as the personal interests of the popular masses. General Secretary Xi Jinping has emphatically pointed out that without cybersecurity, there is no national security, without informatization, there is no modernization. The National People’s Congress attaches high importance to cybersecurity work, deliberated and passed the “National People’s Congress Standing Committee Decision concerning Strengthening Network and Information Security Protection” in December 2012, and deliberated and passed the “Cybersecurity Law of the People’s Republic of China” in November 2016 (hereafter referred to as the “Law and Decision”). On the basis of the 2017 supervisory work plan, the National People’s Congress Standing Committee Law Enforcement Inspection Group has conducted a review of the implementation situation of the “Law and Decision” from August to October 2017. Now, on behalf of the Law Enforcement Inspection Group, I report to the Standing Committee.
I, The work situation of law enforcement inspection.
The Cybersecurity Law took effect on 1 June of this year. Opening a law enforcement inspection of a newly formulated law, having effect for less than three months, is a first in the NPCSC’s supervision work. Committee chair Zhang Dejiang attached full importance to this law enforcement inspection, and provided important instructions, pointing out that cybersecurity affects the country’s long term peace and order, and affects economic and social development as well as the well-being of the popular masses. The NPCSC launching law enforcement inspection in the same year that the Cybersecurity Law has taken effect, is an implementation of the spirit of the important instructions of General Secretary Xi Jinping concerning “we must establish a correct cybersecurity view”, to supervise relevant parties to further strengthen legal propaganda, strengthen the cybersecurity awareness of all of society, grasp the formulation of accompanying laws and policies, ensure the effective implementation of the law, strive to upgrade cyberspace governance levels and realistically safeguarding security in national cyberspace and the lawful rights and interests of the people. We hope that the inspection group have meticulously organized this law enforcement inspection, persisted in problem-based guidance, and found through in facts. On the basis of the spirit of the instructions of Committee chair Zhang Dejiang, the Internal Judicial Committee, Finance and Economics Committee, Education, Science, Culture and Health Committee and the Standing Committee Office researched the matter repeatedly, and established the five focus points of this law enforcement inspection: the first is the situation of conducting legal propaganda and education work; the second is the situation of formulating accompanying regulations and rules; the third is the situation of strengthening critical information infrastructure protection and implementing the multi-level protection system for cybersecurity; the fourth is the situation of bringing online unlawful information under control and safeguarding the benign ecology of cyberspace; and the fifth is the implementation of the citizens’ personal information protection system, and investigating and prosecution unlawful and criminal acts violating citizens’ personal information and related matters.
On 25 August, the Law Enforcement Inspection Group convened its first plenary meeting to convey the important instructions of Committee chair Zhang Dejiang. The meeting heard the reports of the Cyberspace Administration of China, the Ministry of Industry and Information Technology, the Ministry of Public Security, the State Administration of Press, Publications, Radio, Film and Television and the Supreme People’s Court concerning the implementation situation of the “Law and Decision”, the Ministry of Education, the Ministry of Science and Technology and the Ministry of Traffic and Transportation submitted written reporting materials.
On the basis of arrangements, deputy Committee chair and Chef Secretary Wang Zhen, Deputy Committee Chairs Shen Yueyue, Zhang Ping, Wan Exiang, Chen Zhu and myself participated in this law enforcement inspection. The Inspection Group visited six provinces (regions, municipalities) Inner Mongolia, Heilongjiang, Fujian, Henan, Guangdong and Chongqing to conduct investigation, in that period, the Inspection Group heard reports from relevant provincial, municipal and county governments, successively convening over 30 discussion meetings, and inspected several cybersecurity command platforms and critical infrastructure operating work units on the ground. Furthermore, it also entrusted 12 provincial (regional, municipal) People’s Congresses to conduct an investigation of the implementation situation of the “Law and Decision within their administrative area.
In order to deeply understand the implementation situation of the “Law and Decision”, this law enforcement inspection conducted several new trials in terms of methods and approaches: first, it invited third-party expert bodies to participate. From early September until mid-October, the Inspection Group selected 20 important information systems in each of the six provinces (regions, municipalities) for on-the-ground inspection, and entrusted the China Information Security Monitoring Centre with conducting a vulnerability sweep and a mock attack, and issued a specialized monitoring report on the basis of the situation of monitored systems’ cybersecurity. The Inspection Group also entrusted the China Youth Daily Social Survey Centre with conducting popular opinion surveys in 31 provinces (regions, municipalities) on the basis of questions in 10 areas of the “Law and Decision” that closely affect the public, and they issued a survey report. In total, 10370 people participated in this survey. The orderly participation of third-party bodies strengthened the expertise, authority, objectivity and fairness of this inspection. Second, expert participation. Considering the strong specialized nature of cybersecurity, during the law enforcement inspection period, the Inspection Group successively invited 21 cybersecurity experts and technical personnel having engaged in cybersecurity work for a long time from the State Information Technology Security Research Centre and other such work units, to provide technical support to the Investigation Group, and strengthen the focus and efficacy of the inspection. Third, random spot checks. Each small inspection group randomly selected several critical information infrastructure operating work units according to the requirements of the inspection plan, and conducted preliminary spot checks unannounced. Six small inspection groups conducted random spot checks on 13 work units in total. 120 important information systems were monitored remotely, and were also selected randomly by the Law Enforcement Inspection Group, and monitoring was completed under circumstances where the operating work units was not aware of the matter.
II, The method and efficacy of implementing the “Law and Decision””
In recent years, all levels’ Party Committees and governments have earnestly organized study of General Secretary Xi Jinping’s series of important speeches and important judgments concerning cybersecurity, deeply implemented the Centre’s strategic arrangements concerning “building a strong cyber power”, entered cybersecurity into the overall picture of economic and social development and into comprehensive planning and arrangements, forcefully advanced cybersecurity and network information protection work, and legal implementation has seen vigorous results.
(1) Deeply conducting propaganda and education, strengthening cybersecurity awareness.
First, strengthening the entire people’s cybersecurity awareness has been made into a basic task. 9 departments including the Cyberspace Administration of China, the Ministry of Industry and Information Technology and the Ministry of Public Security have, for four successive years, organized and launched Cybersecurity Week and themed days and propaganda activities, lectures, forums, etc. during this period of events annually have exceeded 10.000 in number, with an annual average coverage of around 200 million people. After the promulgation of the Cybersecurity Law, all localities have conducted propaganda and explanation of the core content of the law through newspapers and magazines, radio and television stations, portal websites, governmental microblogs and public channels, etc. Second, strengthening legal propaganda and education in focus work units and focus sectors. The Ministry of Industry and Information Technology has entered learning about the “Law and Decision” into annual assessment standards for basic telecommunications operating enterprises, and organized learning sessions at focus Internet enterprises such as Baidu, Alibaba, Tencent, etc. The Ministry of Public Security has organized concentrated study sessions for the public security bodies nationwide, over 200 Central ministries and commissions as well as Central enterprises, and over 260 information security enterprises and related personnel. The State Administration of Press, Publications, Radio, Film and Television has organized cybersecurity knowledge and skill training and competition activities. Provinces (regions) such as Inner Mongolia and Heilongjiang have conducted focus training for professional backbones in focus work units and focus sectors who are responsible for cybersecurity. Third, closely grasping the critical minority of leading cadres, and making enhancing the cybersecurity awareness of leading cadres into the heaviest of heavies. Localities such as Guangdong and Fujian have promoted leading cadres to take the lead in knowing the law, understanding the law and using the law through organizing cybersecurity and informatization-themed deliberation classes for leading cadres, and other such methods. The Ministry of Traffic and Transportation Party Group’s members have taken the lead in study, and organized a “special training class for bureau-level leading cadres on cybersecurity”, the Ministry of education has organized cybersecurity training classes for the education system, and has conducted topical training for responsible persons in all provincial education administration departments, directly subordinate higher education institute and directly subordinate ministry bodies. All localities have made younger netizens into a focus point for law popularization, launched activities such as “cybersecurity entering campuses and entering households”, “strive to be a netizen with good ‘four haves'”, etc. guiding broad youth into going online in a lawful, civilized and healthy manner.
(2) Formulating accompanying regulations and policies, building cybersecurity structures and systems
In order to support the implementation of the “Law and Decision”, in recent years, relevant state Council departments have published the “National Cyberspace Security Strategy”, the “Telecommunications Cybersecurity Protection Management Rules”, the “Telecommunications and Internet User Personal Information Protection Regulations”, the “Telephone User Real Identity Information Registration Regulations”, the “Press, Publications, Radio, Film and Television Cybersecurity Management Rules”, the “Public Internet Cybersecurity Sudden Incident Emergency Response Plan” and other such accompanying riles, plans and policy documents. The Cybersecurity Administration of China has, together with relevant departments, published the “Some Opinions concerning Strengthening National Cybersecurity Standardization Work”, accelerated the formulation work of cybersecurity standards, and 198 national cybersecurity standards have been published. The Supreme Court and the Supreme Procuratorate have published the “Interpretation concerning Some Questions on Applicable Law when Handling Criminal Cases of Infringement of Citizens’ Personal Information”. Some provinces have also launched accompanying regulation drafting work, the Inner Mongolia Autonomous Region People’s Congress Standing Committee formulated the “Computer Information System Security Protection Rules”, the Fujian Province People’s Congress Standing Committee passed the “Fujian Province Telecommunications Infrastructure Construction and Protection Regulations”, the Guangdong Province People’s Congress Standing Committee published the “Decision concerning Implementing Telecommunications Users Real Identity Information Registration System”, the Heilongjiang Province People’s Congress Standing Committee published the “Industrial Information Security Management Regulations”. Chongqing Municipality persisted in equally stressing cybersecurity and informatization development, strengthening the construction of e-government systems and perfecting governmental website management structures. A series of accompanying regulations, rules and policy documents have been published, assisting in the implementation of the “Law and Decision”.
(3) Enhancing security protection capabilities, striving to ensure the security of network operations
First, strengthening critical information infrastructure protection. In 2016, the Cyberspace Administration of China and other departments organized the launch of critical information infrastructure investigation and inspection work, they conducted spot-checks and technological surveys of 11.000 important infrastructure systems’ operational security state, completed cybersecurity risk assessments in multiple focus sectors including finance, energy, telecommunications, transportation, radio and television, education, healthcare, social security, etc., putting forward over 4000 improvement suggestions. Second, launching network infrastructure protection work. The Ministry of Industry and Information Technology has launched network infrastructure investigation work, completely combing through network infrastructure and information systems, at present, all sectors in total have been determined to contain 11590 critical network infrastructure systems and important information systems. Since 2017, over 900 focus network systems and industrial control systems have been subject to supervision and spot-checks, and 78980 vulnerabilities have been notified for rectification. Third, deeply advancing multi-level cybersecurity protection. 140.000 information systems have already been filed, among whom 1.7000 are third-tier or higher important information systems, this basically covers all critical information infrastructure. At the same time, regularized inspection has been launched for information systems entered into multi-level protection, in recent years, the total of all kinds of security vulnerabilities that have been discovered and rectified approaches 400.000. Fourth, establishing reporting and early warning systems. The Ministry of Public Security has taken the lead in establishing a national cybersecurity reporting and early warning mechanism, with a notification scope already covering 100 Central Party and government bodies, 101 Central enterprises, 31 provinces (regions, municipalities) and the Xinjiang Production-Construction Corps, all localities have also established cybersecurity and information security notification mechanism, to notify and deal with all kinds of vulnerabilities and threats in real time. The Ministry of Education has established security supervision and early warning mechanisms for important websites and information systems in the education system, having already handled 35.000 security threats in total. Fifth, vigorously launching the construction of coordinated joint action platforms for cybersecurity. The Cyberspace Administration of China has taken the lead in establishing emergency response technology support and assistance mechanisms for critical information infrastructure, it has incessantly upgraded the overall emergency response capabilities, security protection capabilities and coordinated joint action capabilities for critical information infrastructures. Sixth, forcefully conducting cybersecurity special campaign work. The Ministry of Public Security has, together with relevant work unit, conducted large-scale special Internet enterprise defence campaigns, website security, as well as Internet and email security special governance campaigns, discovering and rectifying a batch of deep cybersecurity problems and vulnerabilities.
(4) Controlling information violating laws and regulations, and safeguarding a clear and crisp cyberspace
All localities and all relevant departments have earnestly implemented the requirements of the law, soundly performed online ideological work, and firmly cleaned up information violating laws and regulations of all kinds. Through launching a series of campaigns including “sweeping pornography and beating illegality”, the “Web Sword” etc., targeting information propagating terror, violence, obscenity or sex, etc. on Internet sites, application software, blogs, microblogs, public accounts, instant messaging tools or online streaming. Since 2015, the Cyberspace Administration of China and other departments have, according to the law, held talks with over 2200 websites violating laws or regulations, cancelled the permit or filing of websites breaking laws or regulations or closed unlawful websites in over 13.000 cases, relevant websites have, according to user service agreements, closed nearly 10 million accounts violating laws or regulations, creating a powerful deterrence against all kinds of online unlawful conduct. The China Youth Daily Social Survey Centre provided the inspection group with a large-scale survey analysis report (hereafter simply named “mass survey report” which suggests that among the 10370 people participating in the survey, over 90% of respondents affirm the efficacy of governance, and 63,5% among them believe that information violating laws and regulations online including information harming national security, propagating terror, violence, obscenity or sex has clearly reduced. The legal implementation competent departments have also established an online information patrol mechanism and public reporting platforms, to timely clean up information violating laws and regulations. Chongqing and other such localities give high regard to strengthening online content construction, vigorously creating excellent online works and strengthening online positive propaganda.
(5) Strengthening personal information protection, attacking unlawful and criminal infringement of user information security
In comprehensively implementing real identity system requirements for online access (website filing and domain names / IP addresses), fixed telephones and mobile telephones, in all cases where users do not provide real identity information, operators no longer provide related services to them. In the past five years, telecommunications enterprises have organized the accompanying registration of 300 million old users who had not yet submitted their real name, and ceased the provision of services according to the law to over 10 million users who refused to amend their registration. In order to ensure user information security, relevant departments have guided all network operating work units to further strengthen internal control and management structures, requiring them to implement strict management over application, use and period of validity of major operations such as mass data export, reproduction, information deletion, etc., preventing the mass leak of user information through workflows. Henan Province has strengthened security protection of critical systems for user information storage, enhancing capabilities to protect against hacking attacks. With regard to the trend of high incidence of user personal information crimes, the Ministry of Public Security has arranged and launched a dedicated attack campaign, establishing anti-fraud centres in 31 provinces (regions, municipalities) and the Xinjiang Production-Construction Corps, it comprehensively coordinated the attack against the use of citizens’ personal information to conduct telecommunications and online fraud crimes, in the past two years, over 3700 cases of criminal infringement of personal information were cracked, and over 11.000 criminal suspects were arrested. Between 2014 and September 2017, courts nationwide tried 1529 criminal cases where networks were used to infringe citizens’ personal information, gaining relatively good legal effects and social effects.
(6) Expanding support strength, advancing critical cybersecurity technology innovation.
In order to implement the requirements of the Cybersecurity Law to “support focus cybersecurity technology industries and projects, and support the research, development and utilization of cybersecurity technology”, the Ministry of Science and Technology, jointly with the Cyberspace Administration of China, composed dedicated research plans, based on the current development status of cyberspace security, focusing on raising our country’s critical information infrastructure and data security protection capabilities, supporting trusted management of cyberspace and data asset protection, enhancing cyberspace protection capabilities and other such goals, this established research directions in several focus points. In order to expand support to research, development and application support of cybersecurity technology the Ministry of Science and Technology and the Ministry of Industry and Information Technology gave priority to initiating the “Cyberspace Security Focus Earmarks” in the “13th Five-Year Plan Period” national focus research and development plan, with a State-issued funding input of 1.384 billion Yuan, they systematically arranged 47 research tasks, striving to basically create an indigenous and controllable core cybersecurity technology system by the year 2020. Furthermore, in the “Science and Technology Innovation 2030 – Major Projects”, they gave priority to arranging a batch of major cybersecurity research projects, providing technical support to enhancing our country’s information supervision and management, leak and theft of confidential information prevention, cyber defence, etc. The Ministry of Education has innovated cybersecurity talent education models, adding a first-tier cyberspace security discipline, issuing the “Opinions concerning Strengthening Cybersecurity Discipline Construction and Talent Training” together with relevant departments, initiating first-rate cybersecurity academy construction demonstration projects, and thus providing talent support for cybersecurity technology innovation.
III, Difficulties and problems existing in work
The inspection situation shows that various localities still display some difficulties and problems in implementing the “Law and Decision” and in safeguarding aspects of cybersecurity.
(1) Cybersecurity awareness urgently remains to be strengthened
Many critical information infrastructure operating work units have an insufficient understanding of the importance of cybersecurity, they believe that their being cyberattacked is only a low-probability matter, and they lack understanding of the harm from cyberattacks they may receive. In the area of informatization, they are “high on construction, low on security; high on use, low on protection”, they lack awareness about active defence, and are unwilling to conduct the necessary investment in security protection; when handling the relationship between the usability and security of business information systems, they often more emphasize usability, and when there is a conflict with the later, often reduce security requirements. Quite a few local governments’ and departments’ leading cadres cannot understand cybersecurity from the height of national security, they have not entered cybersecurity work on the important work agenda for that level’s government or department, or they only give it priority in name, “saying it is easy, but treating it as secondary, and forgetting it when busy”. The social public’s cybersecurity awareness is generally not strong, the “Mass Survey Report” indicates that 55,4% of respondents believe that many people around them lack a cybersecurity awareness, and “know that cybersecurity exists but do not know much about it”.
(2) Basic cybersecurity construction is generally weak
First, the construction of cybersecurity state sensing platforms is lagging behind. Cybersecurity risks have a strong hidden component, sensing the security state is the most basic and fundamental work to do cybersecurity well. In safeguarding cybersecurity, it is first and foremost necessary to know where the risks are, what the risks are, and when the risks emerge. But quite a few provinces have not yet initiated the construction of cybersecurity state sensing platforms, they cannot realize all-weather, real-time, dynamic monitoring of the cybersecurity risk in important information systems. Second, the construction of disaster-proof back-up systems is generally lagging behind. Quite a few work units operating critical information infrastructure relating to the national economy and the people’s welfare have not conducted remote disaster-proof backups of important data according to legal provision, but have only adopted several simple data back-up measures, some have even not conducted disaster-proof backups, and cannot effectively respond to major data security risks. In several provinces, multiple important information systems have not conducted remote disaster-proof backups according to legal requirements. Third, indigenization levels in important industrial control enterprises’ equipment and control systems remains to be increased. Several important industrial control enterprises heavily rely on foreign technology, not only are production control systems built by foreign companies, but foreign products are also used as accompanying network and security equipment, the deployment of network and security equipment is controlled by foreign personnel, enterprises’ internal personnel even does not hold security equipment deployment and management powers. In some provinces, the indigenization level of important industrial control enterprises’ production control systems is less than 20%. Fourth, emergency response plans are treated as a mere formality. Some cybersecurity emergency response plans are biased towards the elimination of equipment blockages, and their content dealing with cyberattacks, information leaks and other such cyberspace security incidents is relatively limited; some emergency response plans lack feasibility; some emergency response plans have not been revised for a long time, and can no longer respond to the present type of cybersecurity incidents; many work units have not truly organized emergency response drills because they have insufficient conditions to have emergency response drills; quite a few localities and sectors have insufficient funds to be used to resolve cybersecurity problems, and after problems are discovered, they can often not be resolved timely because of funding shortages.
(3) Prominent cybersecurity risks and vulnerabilities
In order to understand the situation of online operations, the law enforcement inspection group entrusted the China Information Security Monitoring Centre with conducting remote penetration tests and vulnerability scans of 120 randomly selected critical information infrastructure systems (60 portal websites and 60 operational systems). This Centre issued a report that stated that among the 120 critical information infrastructure systems undergoing remote monitoring, 30 contained security vulnerabilities, including 12 high-risk vulnerabilities, some provincial-level departments’ comprehensive Internet supervision and management platforms among them contained three high-risk vulnerabilities of unauthorized uploads, unauthorized downloads, and unauthorized deletion, gravely threatening the security of systems and servers, they also contained grave risks of user information leaks. The remote monitoring also discovered that multiple city-level government portal websites contained the risk that pages might be distorted. The law enforcement inspection group’s on-sit spot checks discovered that multiple work units have not retained network daily records according to laws and regulations, this may lead to the impossibility to timely conduct tracing and response measures when a cybersecurity incident occurs; some work units have not conducted risk assessments of important information systems, and lack knowledge of the cybersecurity situation they may face. The inspection also discovered that in multiple work units, the security construction of intranets and private networks has not been given sufficient attention, some work units have not arranged for any security protection equipment of their intranet systems, and not conducted vulnerability scans for a long time, and thus major cybersecurity risks exists. Following the advance of informatization construction in all areas and all localities, the datafication, onlinification and remotization of all sectors and all areas is becoming ever clearer, putting forward higher requirements for cybersecurity.
(4) The situation in user personal information protection work is grim
The “mass survey report” demonstrates that the implementation of many structures in the “Law and Decision” concerning user personal information protection is not ideal: 52.1% percent of interviewees believe that the provisions in the law concerning “online service providers and other enterprise and undertaking work units must, when collecting and using citizens’ personal electronic information during their business operations, indicate the purpose, method and scope for the collection and use of information” has been implemented badly or mediocrely; 49.6% of interviewees have encountered excessive collection of personal information, and 18.3% among them have regularly encountered excessive collection of user information; 61.2% of people have encountered “dictator clauses” where relevant enterprises use their own advantageous position to force the collection and use of user information, and if this is not accepted, the product in question cannot be used, or services received; 52.5% of people believe that law enforcements’ protection of user information has ordinary or bad results, quite a few people reflect that after discovering that their personal information was leaked or abused, it was relatively widespread that reporting was difficult, filing complaints was difficult, and filing cases was difficult. Many interviewees reflected that the problems of excessive collection of user information and infringement of personal privacy exist in a widespread manner in free-of-charge applications, but it seems as if there is no supervision, management or lawful punishment whatsoever. The investigation discovered that some Internet companies and public service departments stored large amounts of citizens’ personal information, but security protection technology was gravely lagging behind, making it easy for law-breakers to steal and abuse it. Several work units’ internal control systems are not perfected or not implemented, a small number of “inside ghosts” have taken the risks in pursuit of unlawful gain, leading to large-scale leaks of user information. In several places at present, the use of networks to illegally collect, steal, peddle and use users’ information has created black industry chains. Cases recently uncovered by public security department recently demonstrate the features of user information leaks such as they have multiple channels, costs for unlawful acts of theft are low, the difficulty of investigation is high, etc., furthermore, law-breakers’ used methods are incessantly improving, cases of “targeted fraud” triggered by user information leaks are increasing, creating grave harm to the popular masses’ asset security.
(5) Cybersecurity law enforcement structures remain to be further smoothened
The phenomenon of “nine dragons ruling the water” in cybersecurity supervision and management still exists, problems such as unclear duties and responsibilities, each fighting their own battles, law enforcement shifts responsibility, efficiency is low, etc., still have not been effectively resolved, the comprehensive coordination role with which the law endowed cybersecurity and informatization departments has been insufficiently unhindered. In several localities, multi-headed management problems in network and information security are relatively prominent, but after information leaks, abuses of user personal information and other such information security incidents occur, users regulatory run into the problems that there is no door to complain to, or departments shift responsibility between them or dispute over trifles. The “mass survey report” reveals that 18.9% of interviewees reflect that, after encountering cybersecurity problems, they do not know which department to go to to file a report or complaint, and even if they have reported the matter, it is often not dealt with or there is no result. Multiple network operating work units participating in the discussions reflect that problems exist in administrative law enforcement, such as different law enforcement departments conduct duplicate inspections of the same work unit or the same item, and even that inspection standards are not identical, different law-implementation competent departments collect data but “interconnection and interaction” cannot yet be realized, regularly bringing increased and extra burdens to network operators. Quite a few people believe that if it is impossible to rationally structure and precisely delineate duties and responsibilities between departments, it will lead to the problem that law enforcement is not coordinated in the process of implementing the multi-level protection system and critical information infrastructure protection system. Furthermore, the investigation discovered that urban rail transport control systems and other such industrial control systems have unclear cybersecurity management responsibility boundaries, operating work units’ implementation of cybersecurity responsibility contains difficulties; supervision, management and administrative law enforcement powers in the telecommunications sector are gravely insufficient, law enforcement forces are not suited to the present sever situation that cybersecurity incidents occur at high frequency.
(6) Accompanying regulations to the Cybersecurity Law remain to be perfected
Quite a few work units reflected that as the basic law in the area of cybersecurity management, quite a few elements from the Cybersecurity Law are principle-type provisions, and true “implementation” still relies on the perfection of accompanying regulations. For example, even though the Cybersecurity Law contains provisions on data security and use, data operations in practice are relatively complicated, and data desensitization standards, inter-enterprise data sharing norms etc. still need relevant regulations and rules to clarify them; the Cybersecurity Law only clarified that critical information infrastructure operators’ data export activities require assessment, but it has not further clarified whether a security assessment is to be conducted for the export of important data held by other network operators. The critical information infrastructure protection system is an important system in the Cybersecurity Law, but understandings at present are not yet uniform with regard to what is critical information infrastructure, standards and procedures to designate critical information infrastructure, etc. this needs to be clarified through accompanying regulations. How critical information infrastructure is to conduct annual inspections and evaluations, how network operators and management departments are to uniformly publish cybersecurity early warning information, how to support indigenous intellectual property rights in cybersecurity, etc., are also waiting for accompanying regulations and rules to be clarified.
(7) There is a cybersecurity talent shortage
Among the 10370 people participating in the investigation, over 69% of interviewees believe that within their work unit or among the people they know, the specialist technical talents who are able to engage in cybersecurity protection with skill is relatively low in number, it is impossible to satisfy real needs, 21.6& among these interviewees believe that within their work unit, there is basically no-one who is well acquainted with cybersecurity protection technology. The investigation situation shows that, regardless of whether a region is economically developed or relatively backward, cybersecurity technology talents are relatively lacking in all cases, existing network operating work units’ technology talents are mostly biased towards systems use, operational maintenance, their capability for cybersecurity risk supervision and control, emergency response and comprehensive defence is insufficient, and it is difficult to respond to the needs of protecting cybersecurity. Some critical information infrastructure core business systems, even though protection systems are installed, upgrades or patches cannot be applied to security software because of a lack of high-level security technology talent, and so this means cybersecurity security protection products can play an effective role with difficulty. Quite a few government portal websites do not have specialized cybersecurity technology talents, website management personnel has not accepted systematic cybersecurity skills training. Furthermore, cybersecurity competent departments’ specialized talents are clearly insufficient in number. Under factor constraints such as personnel appointment, duties, remuneration, etc., many local cybersecurity and informatization, public security, telecommunications management, industry and information technology, and other which work units often are unable to recruit or retain specialized technical talents, first-line law enforcement personnel’s specialist training and skills can hardly gain competence for regularized supervision, management and law enforcement duties for network operational security.
IV, Some suggestions
On the basis of the inspection situation, the inspection group has put forward the following suggestions for further implementing the “Law and Decision”.
(1) Further raising understanding of the importance of cybersecurity
In the information age, cybersecurity has become the fifth space outside terrestrial, maritime, aerial and outer space, it has become a new frontier for national interests and a new area for the strategic game between all major countries worldwide, cybersecurity can affect the entire picture of national security with one move, it has become a national security problem of a fundamental and comprehensive nature. The 19th Party Congress report stressed that cybersecurity and other such non-traditional security matters are one of the common challenges that humanity faces, we must persist in the overall national security view, make the people’s security into the purpose, make political security into the foundation, comprehensively manage external security and internal security, territorial security and citizens’ security, traditional security and non-traditional security, our own security and common security, perfect national security structures and systems, and strengthen the construction of national security capabilities. We must further deepen understanding of the importance of strengthening cybersecurity work under new circumstances, incessantly strengthen our sense of urgency and self-consciousness in implementing the Cybersecurity Law and other such laws and regulations. The competent departments for implementation of law and other related work units must, in integration with their work reality, further strengthen propaganda and training about the Cybersecurity Law, incessantly let the broad network operators, critical information infrastructure operating work units and their relevant personnel be able to know the content of the law, they must also strengthen propaganda for the social public in ways that are pleasing to see and hear, let the broad public understand the close relationship between cybersecurity and themselves, and strengthen the cybersecurity awareness of all of society.
(2) Correctly dealing with the relationship between security and development.
General Secretary Xi Jinping pointed out that cybersecurity and informatization are mutually accompanying. Security is the precondition for development, development is the guarantee for security, security and development must be advanced simultaneously. We must fully understand the role of the Internet in state management, economic development and social governance, continue to advance e-government, e-commerce and new smart city construction, incessantly enhance technological convergence, operational convergence and data convergence, create information “arteries” for economic and social development. We must, according to the requirements in the Cybersecurity Law to “equally stress maintaining cybersecurity and informatization development”, persist in grasping network and informatization development with one hand, and grasping cybersecurity with the other, “grasp with both hands, both hands must be tight”. In cybersecurity, we must give high regard to traditional information security and ideological security, and create a cyberspace with a clear atmosphere, brimming with positive energy, we must also give high regard to enhancing capabilities to defend against attacks, effectively prevent cyber attacks, and realistically safeguard the security of networks and information systems. We must scientifically formulate cybersecurity standards for different sectors and different work units, and earnestly research and resolve the problem that “cybersecurity compliance costs are excessively high” put forward by several work units. Encourage and support the development of the cybersecurity industry, give rein to the role of social forces, and provide secure products and services.
(3) Accelerate the perfection of accompanying regulations and rules of the Cybersecurity Law.
We must accelerate the legislative progress of the “Critical Information Infrastructure Protection Regulations” and the “Cybersecurity Multi-Level Protection Regulations”, make clear provisions on issues that, in practice everyone universally feels are difficult to grasp, such as what is critical information infrastructure, how to determine critical information infrastructure, etc., and further clarify the departmental duties and responsibilities in the process of implementing the multi-level protection system and the critical information infrastructure protection system. Cybersecurity and informatization, telecommunications and public security departments must formulate accompanying regulations or documents as quickly as possible, and create detailed structure for elements of the law such as personal information and important data export security assessment, online data management, cybersecurity monitoring and early warning, information reporting, cybersecurity review, cybersecurity certification and security monitoring result mutual recognition, etc. Several administrative regulations and departmental rules already formulated earlier should also be timely corrected and perfected on the basis of the requirements of the Cybersecurity Law as well as new issues and new questions that were encountered. On the basis of the need to prevent and attack online unlawful and criminal acts, strengthen Internet criminal legislation, research the formulation of a law to prevent and address online unlawful and criminal acts, and promote the effective linkage of administrative punishment and criminal punishment of online unlawful and criminal acts.
(4) Striving to enhance cybersecurity protection capabilities
First, accelerating cybersecurity state sensing platform construction. We must integrate resources from all departments to establish a unified all-weather cybersecurity sensing platform, in order to discover risks and sense risks well, and thereby build uniform and high-efficiency cybersecurity risk discovery mechanisms, notification mechanisms, intelligence sharing mechanisms, deliberation and response mechanisms, and to accurately grasp the laws, trends and tendencies occurring in cybersecurity risks. Second, organizing and conducting risk assessment according to the law. We must, as quickly as possible, perfect cybersecurity risk assessment mechanisms, strengthen assessment in important sectors and areas such as finance, energy, transportation, etc., and on the basis of the assessment situation, adjust cybersecurity work plans and protection measures at suitable times. Third, regularly organizing emergency response drills. Organize critical information infrastructure operating work units to regularly conduct emergency response drills, to ensure that important information systems involving national security, or involving the national economy and the people’s livelihoods to be able to effectively respond against organized, high-strength cyberattacks. Fourth, we must earnestly implement the requirements of the law, accelerate the construction of disaster-proof backups in critical information infrastructure, and regularly conduct testing of their disaster-proof efficacy, enhancing the capabilities of information systems to be resilient to disasters, mitigate disasters and recover. We must supervise network operating work units in earnestly implementing the provisions of the law and preserve network daily records according to the law. Fifth, we must strengthen the construction of cybersecurity confidentiality protection systems, enhance the capabilities of cybersecurity secrecy protection equipment, and enhance the construction of cybersecurity secrecy protection technology safeguard infrastructure. Sixth, we must forcefully advance the domestic production replacement project. Strengthen technological research and development, progressively raise the degree of domestically produced content in information control systems in important industries and enterprises, and increase the indigenous and controllable capabilities in critical information infrastructure and cybersecurity equipment.
(5) Progressively strengthening users’ personal information protection
First, we must accelerate the progress of the personal information protection legislation. Through specialized legislation, clarify the principles and procedures for network operators to collect user information, clarify their secrecy protection and [general] protection duties of collected information, and the liability they shall bear for improper use and weak protection, as well as supervision, inspection and assessment measures. Second, strengthening security protection. Strengthen the construction of data security supervision and management methods, implement tiered and categorized management for data resources, promote the research, development and deployment of security technologies for preventing data disclosure, preventing distortion and preventing leaks in the big data landscape. Third, we must earnestly research the scope and methods for user real-name registration systems, and resolutely avoid the problems that information collection subjects are excessively many in number, and real-name registration items are excessive. All localities and aal work units shall have a clear legal basis for any real identity registration system. We must enhance real identity information collection methods, and reduce the content of real identity information content. Fourth, strengthening supervision and inspection. Establish third-party assessment mechanisms, supervise network operators and public service work units in strictly collecting user information according to the law, establishing and completing internal management mechanisms, and effectively reducing the risk of “inside demons” stealing data. Fifth, further strengthening attack. Public security bodies must strengthen the attack against cyberattacks, online fraud, online harmful information and other such unlawful and criminal activities, sever online criminal profit chains, continue to shape a high-pressure situation, implement the provisions of the law on protecting citizens’ personal information, and ensure that the broad citizens’ lawful rights and interests are not harmed. Sixth, we must perfect complaints reception mechanisms. Research the establishment of uniform and highly effective user information security incident complaint reception mechanisms, to provide a convenience for user complaints and reporting, and safeguard the popular masses’ lawful rights and interests.
(6) Strengthening comprehensive coordination in cybersecurity work
Cybersecurity work involves many domains, has a broad scope, brings heavy tasks, great difficulties, and is strongly systemic, general and coordinated in nature. To respond to complex cybersecurity situations, we must ensure uniform planning, uniform arrangements, uniform standards and uniform progress. We must incessantly perfect online law enforcement coordination mechanisms, complete standardized law enforcement suited to the features of networks as quickly as possible. We must implement regulations related to the Cybersecurity Law, strengthen the construction of cybersecurity law enforcement teams and law enforcement capabilities, strengthen the comprehensive coordination duties and responsibilities of cybersecurity and informatization departments, clarify the boundaries of and interfaces between all functional departments’ powers and responsibilities, create coordinated action mechanisms for departments including cybersecurity and informatization, industry and information technology, public security, secrecy protection, etc., we must both prevent functional overlap and multi-headed management, while also avoiding a pushing away of law enforcement responsibilities, and blank spots in management, incessantly raise law enforcement efficiency, effectively safeguarding cyberspace security. Considering the strong cross-regional nature of the Internet, and the fact that land boundaries are not clear, we must complete and perfect cybersecurity non-local law enforcement cooperation mechanisms, and realize interregional law enforcement joint action. We must also eliminate departmental interests, cut through data and information barriers, reduce duplicate construction, establish shared data platforms, substantially ensure that data collected by different departments can be shared, and raise cybersecurity protection capabilities.
(7) Accelerating the construction of cybersecurity talent teams
Cybersecurity is one of the areas where technological renewal happens the most quickly, competition in cyberspace fundamentally is a competition over talent; to construct a cyber power, the most crucial resource is talent. We must give high regard to cybersecurity talent training work, we must not only foster technical talents proficient in information system use and protection, but we must also foster large batches of talents who are able to conduct cybersecurity risk supervision and control, emergency response and comprehensive protection, and thereby satisfy the demands put forward in the implementation of the Cybersecurity Law. We must further strengthen the construction of cybersecurity academic disciplines, optimize the structuring of teacher teams, reform talent fostering models, foster ever more applied talents who can satisfy practical requirements. We must encourage reforms of network and informatization talents develop mechanisms systems and mechanisms to be conducted and trialled with priority, research the establishment of cybersecurity special talent training, management and incentive mechanisms, strengthen fostering, guidance and support of high-end cybersecurity talents and urgently required talents, ensure that Party and government bodies and critical information infrastructure operating work units are able to find and recruit, use well and can retain “high-end, capable and sharp” specialized talents proficient in cybersecurity technology.
At present, the Internet has deeply merged with all areas of economic development and social life, it has profoundly transformed people’s ways of production and life. We must earnestly study and comprehensively implement the spirit of the 19th Party Congress and especially Xi Jinping Thought on Socialism with Chinese characteristics for a new era, further raise our political stance, firmly establish correct cybersecurity views, further strengthen our sense of urgency and sense of awareness in implementing the law, advance all structures of the “Law and Decision” towards complete implementation, substantially safeguard cyberspace sovereignty and the direct personal interests of the popular masses, and provide firm guarantees for victoriously constructing a moderately prosperous society, gaining magnificent victories for Socialism with Chinese characteristics in a new era, and realizing the Chinese Dream of the great rejuvenation of the Chinese nation.
The digital economy is a driver for global economic growth that becomes more important every day, and is playing an ever more important role in accelerating economic development, enhancing labour productivity in existing industries, fostering new markets and new industrial growth points, realizing inclusive growth and sustainable growth. In order to expand cooperation in the digital economy area, as countries supporting the “One Belt, One Road” initiative, we will, on the basis of the principles of interconnection and interaction, innovation and development, openness and cooperation, harmony and inclusivity, mutual benefit and win-win, explore the common use of digital opportunities and response to challenge, strive to realize an interconnected and interactive “Digital Silk Road” through strengthening policy communication, infrastructure linkages, trade facilitation, financial flows and interlinking popular sentiment, and forge a mutually beneficial, win-win “community of interests” and a “community of destiny” for common development and flourishing. To this end, on the basis of voluntarity and non-restraint, we put forward the following proposal:
1. Expanding broadband access, raising broadband quality. Build and perfect regional telecommunications, Internet, satellite navigation and other such important information infrastructure, stimulate interconnection and interaction, explore the expansion of high-speed Internet access and connectivity measures at a bearable price, stimulate broadband network coverage, improve service capabilities and quality.
2. Stimulating the digital transformation. Stimulate the digitization of agricultural production, operations and management, as well as the networked transformation of agricultural product distribution. Encourage digital technologies to converge with the manufacturing sector, build an ever more linked, networked and smart manufacturing sector. Use information and telecommunications technology to improve cultural education, healthcare and medicine, environmental protection, urban planning and other public services. Stimulate the sustained development of service sectors such as smart logistics, online tourism, mobile payment, digital creativity and the shared economy.
3. Stimulate e-commerce cooperation. Explore the feasibility of establishing information sharing, mutual trust and mutual recognition mechanisms for cross-border e-commerce credit, customs passage, inspection, quarantine, consumer protection and other such areas, strengthen cooperation in areas such as financial payment, storage and logistics, technology services, offline exhibitions, etc. Strengthen cooperation in consumer rights protection.
4. Support Internet start-ups and innovation. Encourage the promotion of Internet-based research, development and innovation through beneficial and transparent legal frameworks, and support Internet-based start-ups. Use the Internet to stimulate innovation in products, services, processes, organizational and commercial models.
5. Stimulate the development of small, mid-size and micro enterprises. Stimulate small, mid-size and micro enterprises to use information and telecommunication technologies to conduct innovation, raise competitiveness and open up new market sales channels through policy support. Promote the provision of required digital infrastructure to small, mid-size and micro enterprises at bearable prices. Encourage small, mid-size and micro enterprises to provide information and telecommunication products and services to public departments, and enter into global value chains.
6. Strengthen digitized skills training. Increase the public’s digitized skills levels, ensure that they obtain gains from the development of the digital economy. Launch on-the-job training for digital skills, enhance employees’ digital skills. Encourage government departments, universities, research bodies and enterprises to vigorously launch training programmes, and stimulate the popularization and improvement of digital skills.
7. Stimulating investment in the information and telecommunications technology area. Improve the commercial environment through stimulating research, development and innovation as well as investment, including cross-border investment in the digital economy. Promote all kinds of financial bodies, multilateral development bodies, etc., to invest in information and telecommunications technology infrastructure and applications, guide commercial share investment funds as well as social funds to invest in the area of the digital economy, encourage public-private partnership relations and other such forms of participation. Encourage the organization of investment information exchange activities between information and telecommunications technology enterprises and financial bodies, encourage reciprocal investment in the information and telecommunications technology area.
8. Promoting inter-city digital economy cooperation. Stimulate relevant cities to launch twinning cooperation, support the establishment of strategic cooperation relationships between twinned cities, drive international traffic and logistics, enhance quality and increase efficiency through constructing information infrastructure, promoting information sharing, stimulating information technology cooperation, and stimulating Internet trading services. Explore the establishment of “Digital Silk Road” economic cooperation demonstration areas. Encourage and support relevant cities in establishing “Digital Silk Road” economic demonstration areas within these cities, promote profound bilateral cooperation in areas such as information infrastructure, smart cities, e-commerce, long-distance healthcare, “Internet Plus”, the Internet of Things, artificial intelligence, etc.
9. Increasing digital inclusivity. Adopt many kinds of policy measures and technological measures to reduce the digital divide, including the digital divide between countries and within countries, and forcefully stimulate the proliferation of the Internet. Stimulate the use of digital technologies in school education and non-official education, promote the realization of broadband access for schools and equip them with online learning environments, so that ever more students can use digitized tools and resources in pursuit of learning. Strengthen the development of digital content such as excellent online games, cartoons, audiovisual materials, literature, music and knowledge resources, and stimulate exchange between the cultures of all countries, and a meeting of people’s hearts.
10. Encouraging and fostering transparent digital economy policies. Develop and maintain an open, transparent and inclusive digital economy policy formulation method. Encourage the dissemination of related and publishable government data, and understand the potential of these in driving new technologies, new products and new services. Encourage online open tendering and procurement, support enterprises in innovating digital product production and services, and simultaneously ensure that demand is market-led.
11. Furthering international standardization cooperation. Propose the formulation and application of international standards for technology products and services developed through joint coordination, these international standards should maintain consistency with international norms including the norms and principles of the World Trade Organization.
12. Strengthening confidence and trust. Strengthen the feasibility, completeness, secrecy and reliability of online transactions. Encourage the development of secure information infrastructure, in order to stimulate trustworthy, stable and reliable Internet applications. Strengthen international cooperation in the area of online trading, jointly attack cybercrime and protect the information and telecommunications technology environment. Through ensuring and respecting privacy and protecting personal data, establish confidence among users, this is a critical factor influencing the development of the digital economy.
13. Encourage and stimulate cooperation while respecting autonomous development paths. Encourage all countries along the Belt and Road to strengthen exchange and enhance mutual understanding, strengthen cooperation in policy formulation, supervision and management, reduce, eliminate or prevent unnecessary differences in supervision and management requirement, in order to liberate the vitality of the digital economy, simultaneously understand that all countries should preserve consistency with their international legal obligations, and that they will plan their development path no the basis of their own development situation, historical and cultural traditions, national legal systems and national development strategies.
14. Encouraging the joint construction of a peaceful, secure, open, cooperative and ordered cyberspace. Support information and telecommunication technology policies that safeguard the global nature of the Internet, permit Internet users to lawfully and autonomously choose the information, knowledge and services they obtain online. Understand that cybersovereignty must be fully respected, safeguard cybersecurity, determinedly attack cyberterrorism and cybercrime, protect personal privacy and information security, and promote the establishment of a multilateral, democratic and transparent international Internet governance system.
15. Encouraging the establishment of multi-level exchange mechanisms. Stimulate all sides, governments, enterprises, scientific research bodies, and sectoral organizations to communicate and interact, share viewpoints, and promote cooperation in the digital economy. Strengthen training, research and cooperation in the area of the digital economy. Strengthen exchanges about policy formulation and legislative experiences among the “Belt-Road Initiative” countries, and share best practices. Launch the construction of digital technology capabilities, welcome and encourage the United Nations Trade and Development Committee, the United Nations Industrial Development Organization, the Organization for Economic Cooperation and Development, the International Telecommunications Union and other such international organizations to play an important role in driving international cooperation on the “Belt-Road Initiative” digital economy.
(Signed by China, Laos, Saudi Arabia, Serbia, Thailand, Turkey and the United Arab Emirates)