China pushes change in IT infrastructure by strengthening regulation of cyber security

Transcription

1 April 2015 China pushes change in IT infrastructure by strengthening regulation of cyber security China pushes change in IT infrastructure by strengthening regulation of cyber security The CBRC s recent initiatives in the Opinion and the Banking IT Guidance, which aim to enhance safety, security and indigenous innovation in China s banking IT sector, have given rise to widespread concerns among financial institutions and IT vendors that the system and infrastructure transitions that the new rules seem to contemplate will bring increased costs and burdens. In this alert, we consider current uncertainties and future concerns sparked by these recent initiatives in the banking sector and the wider implications for China s IT regulatory framework. Contents CBRC s broadly defined new IT requirements for banks... 1 Emphasis on security and controllability... 2 Control of core technology 4 More clarification is expected... 4 Where do we go from here?... 5 CBRC s broadly defined new IT requirements for banks Launched by CBRC in September 2014, the Opinion calls for a fundamental shift in the development of IT infrastructure in China s banking sector through the following key objectives: directed procurement - making openness, transparency and broad applicability the priority criteria in the selection of technology and solutions, giving priority to vendors that are willing to cooperate with financial institutions in respect of core knowledge and key technologies; indigenous innovation - developing a high-performance, stable system for the supply of key technology and being in control of the industry s core IT know-how and technology, including by requiring financial institutions to take the following measures: - strengthening the adaptability, strength and stability of indigenous technology through application modifications, developing uniform standards, product pooling, combination studies and pilot testing in close collaboration with IT vendors and regulators; - if secure and reliable products or technologies containing indigenous Chinese intellectual property are available, selecting at least one such product or technology for testing as part of China pushes change in IT infrastructure by strengthening regulation of cyber security 1

2 their IT procurement process, and requiring the suppliers of specialised equipment or systems solutions to use at least one such product or technology in their hardware and software; and - starting from 2015, allocating at least 5 per cent. of their annual IT budget for research to acquire the core know-how and key technologies of the information technology products/services which they procure; security and controllability - requiring financial institutions to develop core IT that is secure and controllable in partnership with industry, universities and research institutes, and to prioritise its use, including by (i) increasing their proportion of secure and controllable IT by 15 per cent. in each year starting from 2015 and (ii) achieving a 75 per cent. rate of security and controllability in their IT systems by 2019; and diversification - avoiding reliance on a single product or technology, especially in the fields of core information and core IT infrastructure, including by requiring financial institutions to include storage, duplicating, filing and disaster tolerance solutions based on a secure and controllable IT framework in their IT business continuity plans. The Opinion, and the Banking IT Guidance following it, applies to all financial institutions in the banking industry including locally incorporated domestic and foreign commercial banks as well as other institutions such as asset management companies, CBRC-regulated trust companies, finance and financial leasing companies. A literal reading of the Banking IT Guidance would suggest an argument that foreign banks branches in China would fall within the jurisdiction of the new rules. That said, we note that the relevant rules have only been addressed to locally incorporated financial institutions and we understand that CBRC does not intend to apply the new rules to foreign banks branches in China at least at this stage. The Opinion s broad provisions have led to widespread concern in the banking industry and the IT vendors which supply it, especially regarding the extent to which financial institutions would be required to disclose their IT source codes, the extent to which indigenous manufacturing is required and whether the secure and controllable requirement would require them to provide backdoors in their software. Emphasis on security and controllability In the Banking IT Guidance issued on 26 December 2014, the Opinion was clarified by: general concept: further defining the concept of secure and controllable IT it must meet the banking industry s IT security requirements, and possess the ability to control the following risks in the financial institution s IT system: China pushes change in IT infrastructure by strengthening regulation of cyber security 2

3 - the inherent risk and operational risk of information-storing assets (in particular, an institution s use of IT must not compromise (and the IT vendor must ensure) its ability to identify, monitor and control these risks); - risk of loss in performance, business interruption and information leakage, as a result of IT outsourcing; and - risk of system interruption (through inability to obtain necessary maintenance, support, upgrade or otherwise) due to the interruption of the supply chain or restriction in the use of intellectual property for a technology, product or service. minimum proportion: providing a detailed list of what it means for defined categories of IT software, hardware and services to be secure and controllable and the extent to which each category is required to fulfil this objective. For each category of hardware, software and services set out in the Banking IT Guidance, a minimum proportion of total new hardware, software and services falling within the same category which is procured during 2015 is required to be secure and controllable, with the relevant proportion ranging from 15 per cent. to 100 per cent., depending on the nature of the hardware, software and services. specific criteria: setting specific criteria of security and controllability for each category of IT hardware, software and services. The criteria in most cases include the products being tested and certified by the relevant authorities, the suppliers having R&D and service centres in China and the associated software containing indigenous Chinese intellectual property. Specific additional criteria apply to certain hardware, software and services. For instance, source code powering operating systems, database software and middleware must be registered with CBRC to be considered secure and controllable IT, while only wireless routers that have approved encryption or virtual private networking (VPN) certificates may receive the designation. general criteria: in each case, security and controllability of the relevant hardware, software and services is to be assessed on the basis of whether the required assessments and tests have been carried out, the degree of indigenous intellectual property, research and production, the degree of technology and know-how transfer and the vendor s ability to provide services on a continuous basis. IT framework: requiring IT frameworks to be re-engineered in an open and flexible manner and secure and controllable IT be accommodated in their planning and design, with at least one such open and flexible framework, the migration of at least one IT system, and a secure and controllable IT-based business continuity plan to be completed by financial institutions in In general, low-end hardware and software where domestic suppliers already have a strong market position compared with their foreign rivals, including China pushes change in IT infrastructure by strengthening regulation of cyber security 3

4 (among others) network equipment, data storage, low to mid end servers, information security and maintenance services and word processing software, is assigned a higher security and controllability proportion (being 100 per cent. in most cases). While each category of new IT hardware, software and services procured in 2015 is assigned with a minimum security and controllability percentage, no percentage is assigned to each sub-category within a category and it is therefore arguable that the relevant institution has discretion to determine the percentage for each sub-category where the percentage for the overall category is less than 100 per cent. Control of core technology The Banking IT Guidance further defines the Opinion s requirement for a financial institution to be in control of its core technology. It imposes a minimum incremental percentage (varying from 5 per cent. to 15 per cent. depending on the institution) of the total of its important information systems (meaning an information system which supports a critical business and whose information security and service quality affect customers, social order, public interest or national security) procured in 2015 to be under its control. For an important information system to be under an institution s control, the institution must hold the core knowledge and key technology of the system (including its design principles, design structure and source code), own a complete set of usable materials for the system and possess the ability to maintain the system by itself. More clarification is expected We expect further rules and official statements from the Chinese regulators to clarify, implement and update the Opinion will be issued. The Opinion s scope is wider than the Banking IT Guidance and the Banking IT Guidance is itself only valid for 2014 and 2015, thus suggesting that the specific and detailed requirements to further the Opinion s goals will be annually reviewed and regularly updated. For example, how the Opinion s requirements on procurement priorities, collaboration and diversification will be measured and tested is yet to be clarified. At the same time, several of the more onerous requirements of the Banking IT Guidance have been clarified in the Explanation. Firstly, the Explanation states that the specific steps for registration of source code are still in the process of being developed, leaving the requirement to be implemented after all views are fully considered, implying that negotiation with industry and trade representatives on this important point is ongoing. Secondly, the specific requirement of the Banking IT Guidance for certain categories of IT software to contain indigenous intellectual property is limited by the Explanation to the vendor of the software providing proof that it either owns the relevant intellectual property in the software or has otherwise derived it from a legal source. China pushes change in IT infrastructure by strengthening regulation of cyber security 4

5 In addition, the Explanation contains an interesting clarification to the effect that the requirements of the Banking IT Guidance do not differentiate between countries. This appears broadly inconsistent with the Opinion s requirements for financial institutions to develop indigenous banking technology and, in particular, to require their IT suppliers to use at least one secure and reliable technology containing indigenous Chinese intellectual property in their hardware and software. For example, is a bank compelled to choose a secure and reliable Chinese solution where an equivalent foreignmanufactured solution is available? Further clarification is awaited as to how the requirement will work out in practice. Where do we go from here? The new rules provide for CBRC to, on an annual basis, assess the compliance of financial institutions with the rules and factor the results of such assessments into the determination of their final annual regulatory rating. In general, the new rules are broadly defined and where no clarification of terms in an official document is available, CBRC has broad discretion in their interpretation and enforcement. Though, ultimately, the extent to which CBRC is prepared to go in enforcing the more onerous provisions, such as the requirement to file source codes with the CBRC for certain software and to undergo intrusive security testing, remains to be seen (particularly in light of the Explanation), financial institutions and IT vendors should still take the new rules into account in their business infrastructure planning and related systems and procedures for budgeting, procurement, development, outsourcing, maintenance and performance evaluation. The new rules are also broadly reflective of China s progress in the development of a national information security strategy. Market participants should, accordingly, closely monitor related developments, such as the proposals in the Draft Counter-Terrorism Law for network service providers to include technical interfaces which the authorities can use in investigating terrorist activities and provide cryptographic solutions for approval by the relevant authorities, and assess the ability of their business in China to comply with the new requirements. While there may be scope to clarify points of detail to make the new legislation workable, China appears set on a path to protecting the safety, security and sovereignty of its nationwide IT network. China pushes change in IT infrastructure by strengthening regulation of cyber security 5

6 References Opinions of the CBRC on the Use of Secure and Controllable Information Technology to Strengthen Network Security and Informatisation of the Banking Industry ( 银 监 会 关 于 应 用 安 全 可 控 信 息 技 术 加 强 银 行 业 网 络 安 全 和 信 息 化 建 设 的 指 导 意 见 ) ( Opinion ), China Banking Regulatory Commission ( CBRC ), 3 September 2014 Notice of the General Offices of the CBRC and the MIIT on the Guidelines for Secure and Controllable Information Technology in the Banking Industry ( 中 国 银 监 会 办 公 厅 工 业 和 信 息 化 部 办 公 厅 关 于 印 发 银 行 业 应 用 安 全 可 控 信 息 技 术 推 进 指 南 ( 年 度 ) 的 通 知 ) ( Banking IT Guidance ), CBRC and the Ministry of Information Industry ( MIIT ), 26 December 2014 Explanation relating to the Banking IT Guidance ( 关 于 银 行 业 应 用 安 全 可 控 信 息 技 术 推 进 指 南 ( 年 度 ) 的 相 关 说 明 ) ( Explanation ), CBRC, 12 February 2015 Counter-Terrorism Law of the People s Republic of China (Draft) ( 中 华 人 民 共 和 国 反 恐 怖 主 义 法 ( 草 案 ))( Draft Counter-Terrorism Law ), Standing Committee of the National People s Congress of the People s Republic of China, 3 November 2014 Contacts For further information please contact: Jian Fang Partner (+86) jian.fang@linklaters.com Betty Yap Partner (+852) betty.yap@linklaters.com Annabella Fu van Bijnen Partner (+86) annabella.fu@linklaters.com Eric Liu Counsel (+86) eric.liu@linklaters.com Grace Yu Managing Associate (+86) Authors: Bryan Chan, Zhirong Zhou This publication is intended merely to highlight issues and not to be comprehensive, nor to provide legal advice. Should you have any questions on issues reported here or on other areas of law, please contact one of your regular contacts, or contact the editors. Linklaters LLP. All Rights reserved 2015 Linklaters LLP is a limited liability partnership registered in England and Wales with registered number OC It is a law firm authorised and regulated by the Solicitors Regulation Authority. The term partner in relation to Linklaters LLP is used to refer to a member of the LLP or an employee or consultant of Linklaters LLP or any of its affiliated firms or entities with equivalent standing and qualifications. A list of the names of the members of Linklaters LLP and of the non-members who are designated as partners and their professional qualifications is open to inspection at its registered office, One Silk Street, London EC2Y 8HQ, England or on This firm is not authorised under the Financial Services and Markets Act 2000 but we are able in certain circumstances to offer a limited range of investment services to clients because we are regulated by the Law Society of England and Wales. We can provide these investment services if they are an incidental part of the professional services we have been engaged to provide. We currently hold your contact details, which we use to send you newsletters such as this and for other marketing and business communications. We use your contact details for our own internal purposes only. This information is available to our offices worldwide and to those of our associated firms. If any of your details are incorrect or have recently changed, or if you no longer wish to receive this newsletter or other marketing communications, please let us know by ing us at marketing.database@linklaters.com. grace.yu@linklaters.com Linklaters LLP Shanghai Office 29th Floor Mirae Asset Tower 166 Lu Jia Zui Ring Road Shanghai People's Republic of China Telephone Facsimile Linklaters LLP Beijing Office 25th Floor China World Office 1 No. 1 Jian Guo Men Wai Avenue Beijing China Telephone Facsimile Linklaters.com China pushes change in IT infrastructure by strengthening regulation of cyber security 6 A /0.7/03 Apr 2015