Cyber Risks from China: How Contract Negotiations Can Mitigate IT Risks

China's influence on the global economy and technological landscape is significant, yet it is fraught with risks. The country has advanced cyber capabilities, often alleged to be used for cyberattacks on Western organizations, and its manufacturing sector poses supply chain risks due to potential hardware backdoors. Understanding China's strategic intent—especially its perception of opposition from non-socialist countries—is crucial for managing these risks. China's tactics involve creating interdependencies through leading-edge technology provided to developing countries. Cyber espionage, notably by the People's Liberation Army, has been a method to accelerate technological advancements. Intellectual property theft is a core strategy, with various high-profile incidents highlighting the persistent threat. Supply chain reliance on China poses risks not only from geopolitical tensions but also from potential cybersecurity threats. Privacy concerns are paramount as China's surveillance capabilities and different views on personal privacy can compromise data security. China also uses AI and misinformation to conduct fraud and mislead globally. Organizations must adopt serious cybersecurity measures, diverse supply chains, and a risk-based approach to trading with Chinese entities. Training and stringent data management are pivotal to navigating the threats posed by engaging with China.

• The PRC's army has engaged in cyber espionage targeting US organizations from 2006-2014 as per a 2014 indictment.
• Equifax suffered a theft of sensitive data of nearly 150 million Americans in 2017, attributed to the Chinese PLA
• The Volt Typhoon campaign, identified by Microsoft, targeted US critical infrastructure in 2023.
• Huawei's 5G technology was banned from UK networks, to be removed by 2027, following US sanctions.
• The US and UK governments ceased using Huawei's 5G components due to security concerns.
• ASML Holding NV reported unauthorized misappropriation of proprietary technology data by a former employee in China.
• Smart cameras manufactured in China featured vulnerabilities allowing remote access, as investigated by the BBC.
• Chinese electric cars could be remotely immobilized, posing a unique cybersecurity risk.
• The Chinese government can access content on smartphones without physical possession.
• TikTok captures extensive user data, posing a risk of extensive data access by the Chinese government.

• "China probably currently represents the broadest, most active, and persistent cyber espionage threat to U.S. Government and private-sector networks."
• "The security incident may mean that export control regulations had been violated."
• "Professor Saker feared it was impossible to prevent the Chinese from including spyware in the vehicles."
• "Take a risk-based approach to implement good cyber hygiene."
• "Facial recognition technology is fundamental to the Chinese government's control."
• "TikTok’s data collection threatens to allow the Chinese Communist Party access to Americans’ personal information."
• "Negotiate with the mutual dependency of trade in mind."
• "Assume that any electronic equipment carried to China will be compromised."
• "The best defense against cyberattacks is good cyber hygiene."
• "Large organizations have the strength to negotiate assurances against these risks."