CHINA REVISITS MANDATORY CERTIFICATION FOR

UNCLAS SECTION 01 OF 05 BEIJING 002084 State for EAP/CM JYamomoto, PSecor State also for EB/CIP DGross, WWitteman USTR for JMcHale, TWineland, TStratford USDOC for ITA IKasoff USDOC for ITA JEstrada GENEVA PASS USTR SENSITIVE SIPDIS E.O. 12958: N/A TAGS: ECPS ETRD PREL EINV WTRO ECON CH SUBJECT: CHINA REVISITS MANDATORY CERTIFICATION FOR INFORMATION TECHNOLOGY PRODUCTS Ref: A. 2004 BEIJING 3621 B. 2008 BEIJING 1567 ¶1. (U) Summary: Deputy Assistant United States Trade Representative Timothy Wineland met with the Chinese Government and United States industry representatives in Beijing from May 6-16 to discuss China's unprecedented proposal for mandatory certification requirements across a wide range of security-enhanced information and communications technology products. In meetings with China's Certification and Accreditation Administration (CNCA),Ministry of Commerce (MOFCOM),and State Encryption Management Commission (SEMC),Wineland stressed USG and industry concern over the proposed regime and urged continued dialogue to forestall the publication of implementing regulations, which he warned may politicize the issue. Industry representatives shared with Wineland their varying degrees of concern over the proposed regulations, the history of information security in China, and the precedent the new regulations could set if implemented in their current form. The Chinese Government appeared committed to pushing ahead with the measures, but showed some flexibility in the timing of their ultimate implementation and was open to further dialogue. End Summary. Background on China's Information Security Regulations -------------- -------------- ¶2. (U) In August 2007, CNCA notified to the World Trade Organization (WTO) Technical Barriers to Trade (TBT) Committee 13 proposed technical regulations mandating testing and certification for a wide range of commercial, security-enhanced information and communication technology (ICT) products, including: website recovery producs, firewalls, network secure separation card and line selectors, secure separation and information exchange products, secure routers, smartcard chip operating systems, data backup and recovery, secure operating systems, secure databases, anti-spam products, intrusion detection systems, network vulnerability scanners, and security audit products. ¶3. (U) The proposed regulations are potential trade barriers and are a major USG and industry concern in part because of past measures introduced by the Chinese Government in this area. In 1999, the State Council published the Commercial Encryption Administration Regulations, imposing comprehensive restrictions on the research, production, sale, and use of encryption products in China. In 2003, China published regulations to implement the mandatory use of Chinese encryption algorithms for WiFi, the wireless networking technology, under a standard called WAPI, or WLAN Authentication and Privacy Infrastructure (Ref A). In 2006 and 2007, China introduced requirements for foreign companies to register all encryption-enabled products they were using in China. On March 1, 2008, nine Chinese Government ministries and agencies jointly issued the "Regulations on Government Procurement of Information Products Containing Cryptographic Technology," which restricts government procurement of ICT products for national security applications to those products specified in a catalog of approved products maintained by the Ministry of Finance and SEMC (Ref B). ¶4. (SBU) In addition to these regulations, China in December 2007 promulgated specifications related to the Trusted Computing Module (TCM),a Chinese domestic equivalent to the international standard Trusted Platform Module (TPM),used to develop hardware-based encryption in the form of a secure microprocessor chip. The series of ICT security-related initiatives appear to reflect China's continued interest in pursuing ambitious programs to promote domestic standards, control sensitive technology within its borders, and reduce the country's reliance on foreign technology, often despite international protest and without much regard for the practical considerations of their implementation. CNCA Defends Measures, but Shows Flexibility -------------- ¶5. (SBU) In a May 6 meeting with CNCA Chief Technical Supervisor Liu Weijun, Wineland emphasized the concern of the United States government and industry that no country currently requires mandatory information security certification and testing for commercial products. Liu stressed China's concerns for safeguarding information security, which he said was in China's economic, social, and POLITICAL interests. He defended CNCA's proposed regulations as both within WTO rules and in accordance with international practice. That is, he said CNCA's notification of the proposed regulations to the WTO was procedurally correct; and the proposed certification system is in line with China's existing China Compulsory Certificate mark (CCC Mark) scheme (a compulsory safety mark for many categories of products),which he noted includes information technology products and is a system that is employed internationally. ¶6. (SBU) Wineland stressed three main USG concerns stemming from a lack of information on the proposed regulations. First, he asked what additional requirements would be placed on encryption-enabled products during the certification process. Liu replied that any requirements related to encryption would come directly from SEMC, the agency behind China's 1999 encryption regulations and the 2003 WAPI regulations. He added that the new mandatory certification proposal would not create new requirements for encryption products, but would merely follow rules that are already in place, apparently referring to the 1999 regulations. ¶7. (SBU) Second, Wineland inquired whether companies would be required to provide the source code of their products during the certification process. He pointed out that most countries require a limited amount of source code only at higher levels of security assurance typically used in national security applications. Liu replied that all products above a particular security assurance level would require a source code review. He pointed out that this would be equivalent to the international Common Criteria (CC) system, which requires source code review for products above Evaluation Assurance Level (EAL) 4. ¶8. (SBU) Third, Wineland noted that the testing process for certification in most cases takes many months (4 to 24 months, according to the United States General Accounting Office, which also projected the cost of such testing at $80,000 to $350,000),and that CNCA's proposed May 1, 2009 implementation is therefore an area of concern among businesses. He requested that more information be provided about testing labs and processes. Liu acknowledged that the May 1, 2009 implementation deadline does not leave much preparation time, especially because the implementing regulations had not yet been published. As a result, he said that, if certain products need more time to prepare for implementation, CNCA would consider revising the timing of the requirements. ¶9. (SBU) Finally, Wineland warned that, based on precedents set in 1999 and in 2004 with WAPI, encryption issues could quickly become politicized and might have a lasting effect on bilateral relations. This is especially true now, he said, when trade critics in the United States Congress are likely to seize on the issue. As a means to avoid this, Wineland suggested that CNCA not publish the regulations, which were originally expected on May 1 (one year prior to the implementation deadline),and instead continue a working-level dialogue to discuss the details of the regulations and ways to best meet China's legitimate objectives in a way consistent with international norms. Liu was receptive to Wineland's warnings to avoid politicizing the issue, stressing that discussions of the matter should be exclusively technical, and that CNCA is open to talking about how to resolve specific disagreements on the matter to make the system more "scientific and reasonable." He said that the impending implementation regulations or separate guidance would spell out many of the program's technical details and testing requirements, but that their publication had already been delayed in response to feedback received from industry. ¶10. (SBU) Wineland also suggested that China and the United States, in the medium term, consider discussions on the role of the Common Criteria Recognition Arrangement (CCRA),an international framework for specifying, implementing, and evaluating information technology security. Liu responded that China's own requirements were based in many ways on the international standards used in CC. Industry Comments on Proposed Regulations -------------- ¶11. (SBU) In October 2007, following China's TBT notifications, and again on March 25 and April 18, 2008, United States industry associations submitted to CNCA comments on China's proposed information security regulations. The submissions were prepared by the United States Information Technology Office (USITO), Telecommunications Industry Association (TIA), Software Information Industry Association (SIIA), Semiconductor Industry Association (SIA),Information Technology Industry Council (ITI),and American Electronics Association (AeA). ¶12. (SBU) In their comments, the affected industry groups raised a series of concerns. First, multinational companies reported that in no other market in the world are they required to undertake mandatory conformity assessments in the scale or specificity outlined by CNCA. They questioned why China's information security needs differ from the rest of the world, and warned of a chilling effect on trade due to unnecessary and duplicative requirements and significant border delays for imports to China. Next, they noted that products already broadly utilized in the global market will be subject to Chinese standards that have not been vetted internationally for reliability, interoperability, or performance to users. The requirement, they said, may force the development of bifurcated product lines, causing a significant barrier to trade and the possibility of discriminatory treatment for overseas products. ¶13. (SBU) Furthermore, United States businesses questioned CNCA's use of only Chinese domestic (GB/T or YD/T) standards in technical proposals, noting that international IT companies have had no opportunity to participate in the development and approval of these standards, some of which appear to be out of date compared with international standards. Companies also raised concerns that China's testing and certification labs are all affiliated with the Chinese Government, and are not independent, internationally-recognized labs that are used in other foreign countries. Among other issues, industry noted that the proposed testing regime raises concerns over confidentiality and intellectual property rights protection. In separate meetings with Wineland in Beijing, industry representatives elaborated on these concerns. SEMC Clarifies Encryption Requirements -------------- ¶14. (SBU) Finally, industry provided a separate set of comments focused specifically on the implementation of cryptographic requirements under CNCA's proposed certification system. In particular, companies raised concerns over secure databases, secure operating systems, secure routers, and smartcard operating systems, each of which will apparently be required to conform to new encryption requirements, incorporated by reference into the CCC Mark certification process. In response to Wineland's questions on this matter, CNCA responded that encryption matters are not within their purview, and that such requirements are established by SEMC. In a May 15 meeting with Wineland, SEMC Director Mme. Qiang Zhijun confirmed the four suspected categories of secure products would require source code review prior to certification, and that in fact SEMC's regulatory authority extended only to those products. She did note, however, that the 13 product categories already notified to the WTO were only "the first batch" of products to be certified, and that there will be more in the future, at which point SEMC's testing for encryption products could expand beyond the current four products. ¶15. (SBU) Qiang said that SEMC would soon publish detailed guidelines for testing procedures related to encryption products. When asked, she said definitively that included products would not be required to use Chinese encryption algorithms, but that foreign, publicly-available algorithms could also be used, as long as they passed testing. In either case, however, she said that source code review would be required for testing, which would take place in four dedicated labs, separate from CNCA testing for the other product categories. SEMC's labs, she added, are "basically ready" for testing. When asked, she said that the SEMC test for the four cited products would be in addition to, not in lieu of, CNCA testing process. MOFCOM Meetings -------------- ¶16. (SBU) In two separate meetings with MOFCOM officials, one with Americas DDG Wang Hongbo on May 9 and one with WTO Affairs DDG E Defeng on May 15, Wineland outlined both the substantive concerns of the United States Government not only with the 13 draft regulations, but also with precedents set by China in the encryption sector. Wineland indicated to MOFCOM that, while China's draft regulations remain in draft form, working level consultations and dialogue are the preferred means of engagement and progress on the issue, to ensure that China's regulations in this area can achieve China's legitimate objectives in a manner consistent with international norms and practices. However, were China to publish the final regulations with a date-certain implementation deadline, this would necessarily elevate this issue in the United States to a POLITICAL level, given the serious substantive concerns of the United States Government about the regulations as well as past precedent in the area of Chinese encryption and information security rules. MOFCOM officials indicated their interest in not politicizing this issue, and Wineland agreed that this is possible and preferred, so long as dialogue continues and final regulations are not published. Third Country Engagement -------------- ¶17. (SBU) In a meeting with European Union officials in Beijing on May 13, Wineland briefed the EU on USG concerns about the 13 regulations as well as China's response, and expressed USG appreciation for EU support for the US intervention at the March 2008 WTO TBT Committee meeting in Geneva, where the issue was raised. EU officials indicated that they would report United States Government concerns and China's response to Brussels, and looked forward to working together where possible. In a subsequent meeting in Tokyo on May 16, Wineland and Japanese trade officials also exchanged views on this issue (Septel). Comment -------------- ¶18. (SBU) China's proposed regulations are unprecedented in scope because they would require mandatory testing and certification not only for products procured by the Chinese Government for national security applications, but for all commercial IT products in 13 categories, from anti-virus software to hardware such as routers. Furthermore, the proposed scheme requires conformity with China's domestic standards, many of which are still unavailable, and which do not appear to have been developed in an open or transparent manner. Because the current proposed regulations are based on (as yet unknown) domestic standards, the initiative is reminiscent of China's push for WAPI in 2003. WAPI was met with fierce international resistance and was ultimately suspended indefinitely. However, the Chinese Government expressed in various meetings their determination to move forward with the current measures, but showed some flexibility in the timing of implementation and a willingness o continue discussions on the topic. End Coment.