Stiffer Bank-Technology Rules Loom in China

With the US government having backdoors into US based tech there are...... Aivars Lode avantce

Stiffer Bank-Technology Rules Loom in China
Beijing presses for secure and controllable systems; suppliers fear intrusive measures

By Gillian Wong And Eva Dou

March 15, 2015 5:43 p.m. ET

BEIJING—U.S. technology companies need to confront difficult choices amid new bank-security rules in China, as Beijing offers few signs that it will abandon measures that could limit the IT firms’ sales to the big market.

Banks faced a Sunday deadline to submit plans to Chinese officials on how they will convert their internal technology into what Beijing considers secure and controllable systems. The rules require that companies turn over proprietary source codes—the secret ingredients of software—and encryption keys protecting sensitive data, use Chinese encryption keys and submit to intense testing. That has prompted criticism from U.S. and European trade groupsthat the measures are too intrusive.

Technology-company executives say privately that they think China might back down on demands for source codes, the thorniest issue. But as China seeks to wean itself off foreign technologies, global tech companies are weighing a number of limited options: hand over proprietary information in return for market access, form joint ventures with Chinese firms, create products or services only for the Chinese market that meet Beijing’s requirements, or leave.

Industry insiders say the rules are being interpreted as government orders for banks to switch to Chinese vendors and that the requirements would seriously hurt the major U.S. companies that supply the sector.

Trade groups and industry insiders described a flurry of discussions about the technology rules in recent days between U.S. and Chinese officials, including during Deputy U.S. Trade Representative Robert Holleyman’s visit to China last week.

U.S. Embassy officials met with China banking regulators on Thursday, said people familiar with the matter. A visit by Chinese Vice Premier Ma Kai to CeBit, a business information-technology trade fair in Germany that began Sunday, is expected to include sideline talks on the banking regulations, according to people familiar with the matter.

Meanwhile, technology companies must wait to see how banks in China deal with the rules. While the initial plans were due Sunday, the regulations give banks annual targets through 2019, when three-quarters of their systems have to qualify as secure and controllable. The detailed requirements—as spelled out in a December document reviewed by The Wall Street Journal—vary widely, ranging from an immediate requirement for purchasing desktop computers to a much less specific requirement to study alternatives to companies’ current mainframe servers.

A banking executive said many Chinese banks have formed teams to assess ways to cut their reliance on foreign technology but that it could be a yearslong process. People in the industry say the banking sector is highly dependent on foreign technology for its most critical tasks.

The China Banking Regulatory Commission didn’t respond to requests for comment. In February, as tech-industry resistance to the new rules grew, it said it would listen to all sides on the issue of source codes before enacting the rules.

The banking requirements are part of Beijing’s broader strategy to block foreign spying but are seen by Western officials and trade groups as also intended to shut out foreign vendors from an important and fast-growing market. Some foreign companies fear a shift is under way in China that forces them to contemplate the extent to which they compromise their independence in order to stay in a market many of them consider crucial.

The concern is that “these are industrial policy measures basically to promote Chinese businesses at the expense of foreign businesses, and impose Chinese technology on companies,” said Peter Allgeier,president of the Washington, D.C.,-based Coalition of Services Industries, which represents industries as diverse as financial and telecommunications services. He said companies feared their technology would end up in the hands of competitors.

Technology-industry insiders have expressed unease that there are few options available, given Beijing’s increasing confidence in exerting its regulatory power and the companies’ need to stay in the Chinese market. “There’s a fear that this tide is rolling and it may be unstoppable,” said a person familiar with the new rules.

‘The risk is if the banking rules are in fact at the vanguard of a broader network-security campaign that could potentially affect a broader cross-section of the Chinese market.’

—Paul McKenzie, of law firm Morrison & Foerster

The bank-technology rules are the latest in a series of Chinese moves that have worried foreign businesses. Business groups have criticized antimonopoly and anticorruption probes that have centered on multinational car and drug makers and technology companies. A draft counterterrorism law that requires telecom companies and Internet operators to aid Chinese security agencies has also drawn criticism.

China has sought to cut its reliance on foreign technology suppliers. Efforts accelerated after former U.S. National Security Agency contractor Edward Snowden revealed the U.S. government used tech companies to spy on foreign governments. State-run Chinese media have questioned the security of U.S. tech companies such as Apple Inc. and Microsoft Corp. Apple has said it doesn’t provide government agencies with direct access to its servers, and Microsoft has publicized its efforts to resist government requests for data.

Trade groups expect similar technology requirements to be expanded to other sectors Beijing deems critical, such as transportation and energy. Research firm IDC says IT spending in China this year is likely to increase more than 11% to exceed $465 billion.

“The risk is if the banking rules are in fact at the vanguard of a broader network-security campaign that could potentially affect a broader cross-section of the Chinese market,” said Paul McKenzie, a Beijing-based lawyer with Morrison & Foerster LLP, a firm that advises global technology companies.

Foreign IT firms might consider localizing more of their operations in China or developing products specifically for the Chinese market that meet the government’s network-security requirements, he said.

For now, companies have turned to U.S. and European trade groups to help push back against the banking regulator’s rules and the draft counterterror law. President Barack Obama raised the issues in a recent call with Chinese President Xi Jinping.