Understanding China’s Approach to Cyberspace: Strategic and Security Considerations for Europe

The Advisory Note updates the 2023 report on cybersecurity risks associated with China, reflecting on recent developments and new insights. The Chinese perspective on cybersecurity is deeply tied to its historical experiences of foreign interference and sovereignty, doctrines that shape its strategic control over cyberspace through instruments like the Golden Shield Project. While emphasizing its independence, China is accused of cybercrimes, intellectual property theft, and violations of international norms, heightening commercial and geopolitical risks for global partners. China's considerable role in the global supply chain creates cybersecurity challenges, particularly as Chinese components may have hidden vulnerabilities. European businesses, essential to EU-China trade worth billions, are advised to proactively manage these risks by understanding Chinese strategic behaviors, leveraging mutual dependencies, and enhancing cybersecurity measures. The evolving narrative shows China's technological strides against Western constraints, although dependence on Chinese goods poses significant risks. Critical examination of cyber incidents connected to China illustrates how it employs sophisticated techniques for strategic cyber operations, posing threats to sectors like telecommunications and crucial infrastructures. Furthermore, China’s concept of cyber sovereignty and supply chain initiatives reflect its endeavor to maintain control over the internet and influence global norms. Recommendations stress enhanced cybersecurity measures, diversified supply chains, and strategic negotiations.

• China’s cyberspace strategy is rooted in historical experiences of foreign interference and a focus on sovereignty.
• Bilateral trade between the EU and China reached €739 billion in 2023, underscoring mutual economic dependencies.
• China announced a $8.2 billion AI fund following U.S. export controls on semiconductors.
• DeepSeek, a Chinese AI initiative, used open-source models, raising questions about true innovation claims.
• Lei Xiaofang and Jiang Shigong are notable Chinese scholars advocating for China’s own sphere of influence against Western dominance.
• China’s state-sponsored cyber actors, identified in incidents like the Equifax breach, indicate extensive cyber capabilities.
• The Chinese Cybersecurity Law enforces data localization, impacting multinational corporations operating within China.
• High-profile hacking groups like Volt Typhoon demonstrate targeted offensive operations attributed to China.
• Huawei's exclusion from the UK's 5G network highlights significant security concerns related to Chinese technology.
• Allegations of Chinese interference in submarine cable incidents reveal potential espionage activities.

• "If you open the window, both fresh air and flies will be blown in."
• "Socialism with Chinese characteristics is not an empty slogan but instead a description of the Chinese political economy."
• "Cutting foreign competitors out of the market would be bad economics."
• "Trading creates a mutual dependency where each side stands to lose if the other is deterred from trading."
• "Faced with sanctions limiting access to critical hardware and software, the country is now leveraging its highly educated and motivated workforce to develop alternatives."
• "AI requires more than just fearmongering—it needs real solutions."
• "National security is dependent on strict digital borders, which reinforces the need for cyber sovereignty."
• "Innovation is key, even with limited AI investment, there are still opportunities to stay competitive."
• "The EU must focus on strengthening alliances with international partners who share common values and objectives."
• "Dependence on imports and foreign producers is now considered a national security risk in many countries."