社群媒體的普及改變了人們吸收資訊的方式，衝擊了原有的選戰型態。2018到2020年，台灣面臨了新形態的選戰威脅，攻擊者利用社群媒體散播大量的假新聞、不實資訊、仇恨言論。這些攻擊就像高傳染力的病毒不僅會觸及所有社群媒體使用者，更會讓他們感染後進一步成為潛在的假消息散播源。

TeamT5 的 Observations on 2020 Taiwanese General Elections 認為：

## 1. 假新聞讓各政黨支持者成為可能的散播源

   假新聞攻擊會利用選民對政治的熱情，使參與討論的選民反而成為散播的節點。

## 2. 假新聞的手法與目標持續地改變

   中選會認為這次選前的假新聞攻擊達到以往不曾有的數量。而除了數量與手法的不同，在選舉過後，相關攻擊並沒有停止，反而轉移了目標。

## 3. 中國持續加大自己的影響力

   從對台機構的新聞網站到各類假帳號、機器人與自發的小粉紅，中國試圖將影響力延伸到台灣的社群媒體。

## 4. 假新聞的攻擊行動被層層外包

   在選舉期間大量的行銷公司與新興媒體成立並散播特定政治訊息，讓真正的攻擊者可以輕易地隱藏於之後。



我們以資安研究員的角度出發，整合過去兩年間 TeamT5 拆解過的選舉假新聞攻擊事件，希望能替下一場民主選舉貢獻心力。

若對本份白皮書有興趣，請填寫表單，我們會以電子郵件的方式寄送。 TeamT5 接下來還會解析中國如何對內與對外利用社群媒體進行資訊的操弄。不想錯過我們接下來發布的報告，請追蹤我們的[Twitter](https://twitter.com/TeamT5_Official)

TeamT5 發布了〈資訊戰白皮書：2020台灣大選觀察〉

The ubiquity of social media has altered the way people consume information, which in turn dramatically changed the way electoral campaigns are run. From the 2018 municipal elections to the 2020 general elections, Taiwan has witnessed the growing threat of disinformation to the citizens. It was observed that many malicious actors utilized social media to disseminate a huge amount of fake news, false information, and hate speech. These disinformation are like highly contagious viruses that will not only affect the people consuming them, but also make them secondary disseminators. We assess that:

## 1. Virus-like disinformation makes everyone on social media both victim and disseminator

   Although public discussion is the cornerstone of a good democratic society, many attacks have used voter enthusiasm to spread on social media. We have observed that many of the voters who participated in the discussion turned out to be the source of dissemination.

## 2. Disinformation continues to evolve in tactics and quantity, as well as expanding its targets

   The Taiwanese Central Election Commission (CEC) stated that the number of disinformation cases before the 2020 elections reached an unprecedented level. In addition to the evolution in quantity and tactics, we observed that the dissemination of disinformation did not stop even after the election, but instead shifted the target.

## 3. China continues to increase its influence

   Apart from news agency promoting the Chinese policies, inauthentic accounts run by bot, and patriotic netizens (A.K.A little pink), China has stepped up its influence on social media platforms to shape narratives.

## 4. Information operations are outsourced, layer-by-layer

   Before the elections, a number of marketing firms and new media were established to spread political messages. We discovered that some of them have connections with certain political parties, implying the layer-by-layer outsourcing of Information Operations by politically motivated actors.

From the perspective of security researchers, we integrated the Information Operations intercepted and investigated by TeamT5 over the past two years, hoping to contribute to the next democratic election.

If you are interested in this white paper, please fill out the form, and we will send you the report by email.

COMING UP NEXT: We will publish reports about how China conduct Information Operation on social media platforms, targeting domestic citizens and foreign audiences. If you don't want to miss our next report, follow us on [Twitter](https://twitter.com/TeamT5_Official).

TeamT5 Information Operation White Paper I: Observations on 2020 Taiwanese General Elections

面對中國日趨積極、強烈的資訊操弄（Social Manipulation），TeamT5情資團隊以資訊安全研究員的視角，推出最新的〈資訊戰白皮書二部曲〉（Information Operation White Paper），進一步分析中國在「防火長城」（Great Firewall）內，如何透過社群媒體進行數位政治宣傳（Digital Propaganda）。

除了廣為人知的言論審查制度，中國在防火長城內的資訊操弄，更包含主動的數位政治宣傳。從2019年香港反送中抗爭事件，到2020年的新冠肺炎疫情，我們可以清楚看到中國越來越「爐火純青」的數位政治宣傳實力。防火長城內對社群媒體的操控，神秘、難以探知，中國更設法將牆內轉化成中國共產黨的「一言堂」，阻止了理性政治討論的可能性。

在〈資訊戰白皮書二部曲〉中，我們聚焦於：

1.	近年來，中國藉由大量的網路相關立法與集中整併政府資源，強化網路控制。而控制公眾言論的數位政治宣傳，就是中國網路治理的「最後一哩路」。

2.	我們認為中國的數位政治宣傳機制，依循著一個極為有效的「配方」（Digital Propaganda Formula），由四個要素組成：官方媒體、共青團、政務新媒體，以及中國的水軍大隊。

3.	在中國政府資源帶領下，「輿情引導產業」興起，提供人工智慧與大數據工具，替政府收集、儲存、進而分析網路民意。

4.	我們認為，中國藉著其政治宣傳配方來穩定牆內的網路生態，而下一步，就是要將自身在西方社群媒體的影響力，擴張到國外，競逐世界話語權。

在疫情之後，網路世界成為新常態（new normal）不可或缺的一部分。但於此同時，也讓網路威脅，不論是傳統駭客行動者或是社群媒體操弄者（influence operators），有更多機會發動攻擊。TeamT5情資團隊致力於傳遞有用的情資與協助決策的分析報告，希望對提升網路安全盡一份心力。

若您對我們的白皮書有興趣，請填寫以下表單，取得完整的研究報告。

 

**下期預告**

在接下來的〈資訊戰白皮書三部曲〉中，我們將討論中國對外的政治宣傳，看中國政治宣傳機器的現況與其影響，以及中國在西方社群媒體平台上的資訊作戰。

不想錯過我們接下來發布的報告，請追蹤我們的 [Twitter](https://twitter.com/TeamT5_Official)。

TeamT5〈資訊戰白皮書二部曲：中國防火長城內的數位政治宣傳〉

To confront the emerging threat of China's Information Operation, TeamT5 threat intelligence team publishes this White Paper covering how China conduct information manipulation across Chinese social media platforms. From the 2019 Hong Kong Protest to the 2020 COVID-19 pandemic, China has demonstrated the art of surveillance, censorship, and most importantly, digital propaganda.

In this white paper, we focus on China's digital propaganda inside the Great Firewall. We suggest that the regime has developed a unique, organizational, and sophisticated propaganda mechanism, which we dub as "digital propaganda formula." With this formula, the Chinese Communist Party (CCP) has managed to transform all the Chinese social media platforms inside the Great Firewall into an almost total pro-CCP environment.

## Key Takeaways

1. CCP has strengthened its control over Chinese cyberspace by establishing legislations as well as centralizing administrations, and the "last mile" of its cyber governance is to control public opinion through censorship and digital propaganda.

2. We dub China's sophisticated propaganda mechanism the "digital propaganda formula," which consists of state media, communist youth league, governmental affairs new media, as well as trolling factory.

3. Moreover, CCP's policies have bolstered the industry of "public opinion guidance" in China. The industry practitioners have developed AI and big data-powered systems to help the government to collect, store, and analyze public sentiment.

4. China's formula has polluted the online information environment inside the Great Firewall. We assess that the CCP is trying to project its digital propaganda dominance to foreign social media platforms in order to control the world's discourse power. 

Following the global pandemic, the world relies on the internet more than ever. Cyber threat actors and influence operators, either state-backed or money driven, are taking the advantage to conduct information operation. TeamT5 threat intelligence team aims to deliver actionable intelligence and penetrating analytics and contribute to the safeguarding of cyberspace.

If you are interested in this white paper, please fill out the form below and get the full-text PDF.

 

**COMING UP NEXT**

In Part 3 of our Information Operation White Paper, we will focus on the external propaganda of the CCP. We will provide an overview of the current status and impact of Chinese propaganda machine and information operation on Western social media platforms, such as Facebook, Twitter, and YouTube.

If you don't want to miss our next report, follow us on [Twitter](https://twitter.com/TeamT5_Official).

TeamT5 Information Operation White Paper II: China’s Digital Propaganda Formula inside the Great Firewall

インフォメーション オペレーション

Information Operation

在 TeamT5〈資訊戰白皮書〉的最後一部曲中，我們將呈現中國的資訊作戰（Information Operation）是如何瞄準全球社群媒體使用者。TeamT5 希望透過這系列白皮書，分享我們作為資安研究員，如何理解中國的社群操弄。

此份白皮書的前兩個章節，介紹中國檯面上與檯面下的行動。首先觀察中國在檯面上（overt operation）如何透過中國的官媒、大使館、外交官，在社群媒體創造自己的聲量。接著分析中國檯面下的行動（covert operation），進一步研究那些無法被輕易歸因的粉絲頁、內容農場與大量的僵屍帳號。最後一章將以 PTT 論壇上關於 Juiker 的假新聞攻擊為例，提出資訊戰當中，我們最擔心的 —— 由「進階持續性滲透威脅」（APT）發起的假新聞攻擊。

 
## 報告摘要

### 1. 中國持續透過官媒與外交官進行檯面上的社群操弄

中國的官媒、外交官、大使館是中國檯面上的主要行動者。這些行動者負責美化中國外在形象，以及散播對中國執政黨有利的論述。根據我們的觀察，這些帳號在西方社群媒體中都擁有大量的追蹤者，Facebook 粉絲頁中，追蹤數排名世界前 20 名的新聞媒體，第一名到第四名就是由中國官媒粉絲頁 CGTN、China Daily、People's Daily、Xinhua News 包辦。中國檯面上的社群操弄，主要針對位在美國、加拿大、澳洲等英語系國家的海外華人，並透過他們對當地的政治進行一定影響。
 
### 2. 檯面下的社群操弄持續在西方主流社群平台出沒

2020 年，西方主流社群平台 Facebook、Twitter、Google 等，都曾數次移除各自平台上與中國有關的假帳號。儘管平台方已如此頻繁地掃蕩，許多隱匿的行動者仍然在各大平台上出沒，那些曾遭移除的帳號背後，有行動者持續透過註冊新網域和帳號捲土重來。我們不斷觀察到許多可疑帳號，例如許多擁有中國管理員的粉絲頁，會搬運微博上的政治宣傳。更有甚者，我們發現許多配備精良的攻擊者，會自己架設網站和疑似是自動化產生的僵屍帳號，來協助中國政府攻擊香港抗爭者。
 
### 3. APT 攻擊者很可能參與了社群媒體上的資訊戰

我們擔心 APT 攻擊者很可能參與了社群媒體上的資訊戰。APT 通常是由一個國家所支持的駭客團體，以竊取機敏資料為主，APT 的攻擊者往往具備了強悍的網路攻擊手法與資源。然而，我們今年偵察到了一個可能是由 APT 攻擊者發動的假新聞攻擊。該事件發生在 2020 年七月，PTT 論壇八卦版上，開始有許多被盜用的帳號以假新聞攻擊台灣重要軍事單位，造謠台灣公務機關使用的 Juiker 通訊軟體遭駭，以及台灣重要軍事機關遭駭。我們透過搜索比對貼文與發文 IP，發現其中一個 IP 位址，符合某個中國 APT 曾經使用過的中繼站。
 
### 4. 威脅情資作為對抗資訊戰的重要環節

如同前述的分析脈絡，APT 與社群操弄的結合會讓防守方更加棘手。在棘手的防守環境中，唯有威脅情資（threat intelligence）可以提供即時的分析，評估攻擊者的攻擊手法、可疑的指標、以及造成的風險。而在快速更迭的社群媒體環境中，平台方與事實查核團體非常難找到證據，歸因大量散播的假新聞。我們認為唯有導入威脅情資，才能有效幫助政府單位、重要關鍵基礎設施與企業，對抗資訊戰。
 


若您對我們的白皮書有興趣，請填寫以下表單，取得完整的研究報告。
 
 
追蹤 TeamT5 [Twitter](https://twitter.com/TeamT5_Official)，資安動態不漏接！

TeamT5〈資訊戰白皮書三部曲：中國的社群操弄〉

In the final part of our Information Operation White Paper, we will demonstrate China's Information Operations (InfoOps) targeting the global audience. The first part of the report displays a brief overview of its overt operations which are carried out by state media, embassies, and diplomats. Then we look into the covert operations, which can be observed in pro-China fan pages, content farms, and spam botnet. Last but not least, we provide the case study of "Operation Juiker" on Taiwan's largest forum PTT, which suggests the possibility of the APT (Advanced Persistent Threat) actors entering the threat landscape.

## Key Takeaways

### 1. China has escalated the level of overt InfoOps via state-media and diplomats.
 
 
Chinese state media, diplomats, and embassies are the main actors of Chinese overt InfoOps. They shoulder the task to polish the image of the regime and propagate the narrative of the Chinese Communist Party (CCP). It is noteworthy that their official accounts have obtained an unexpected number of followers in recent years. For instance, four Chinese state media are included in the top 20 most-followed pages on Facebook. Their main audience, apart from the Chinese citizens, are overseas Chinese diaspora, which many of them have rights to vote in countries such as the U.S., Canada, and Australia, thus having the ability to influence a country's politics.
 
 
### 2. Covert InfoOps remain active on Western social media platforms.
 
 
2020 is a year which has set many records. This year, the takedowns of covert Chinese social media accounts by Facebook, Twitter, and Google are more frequent than ever. However, even with such efforts, we observed that there are new covert actors emerging across the platforms, while the banned actors keep coming back to the scene by registering new domains and new accounts. We spotted that there is a huge number of Facebook pages with admins located in China dedicated to disseminating Chinese propaganda content originated from Chinese social media platform, Weibo. Besides, there are sophisticated actors that create websites and subtle content to help the Chinese government shaping the narrative for the Hong Kong protest. We also detected numerous networks of pro-China political accounts that demonstrated strong signs of automated behavior.
 
 
### 3. APT actors might have entered the InfoOps threat landscape.
 
 
The situation is become more alarming as we discovered that the Advanced Persistent Threat (APT) actors might have entered the InfoOps threat landscape. APT actors, typically a state-sponsored group, usually conduct prolonged and targeted cyberattacks to mine highly sensitive data. However, in mid-2020, we identified an InfoOp that can be linked to a notorious Chinese APT group which TeamT5 intelligence team has tracked for years. We discovered that the threat actors had disseminated disinformation about "Juiker," a messaging app developed by Taiwan's research institute and widely used by government units, on Taiwan's largest forum PTT. The operation, which we dub as "Operation Juiker," aimed to discredit Taiwan's intelligence agency and government-backed research institute by spreading disinformation of the messaging app being hacked.
 
 
### 4. It is more crucial than ever to adopt threat intelligence solutions to combat the issue.
 
 
The abovementioned Operation Juiker has well demonstrated the possibility of "APT + InfoOp" attack model, which involves targeted social media campaigns disseminating disinformation based on highly confidential data. Such situation is super tricky, and it could pose a great threat to democratic countries. In this case, threat intelligence can help provide instant analysis of actor methodologies, suspicious indicators, and potential risks. We suggest that it is crucial for government units, critical infrastructure operators, and major business vendors to apply threat intelligence to combat this issue.
 
 

If you are interested in this white paper, please fill out the form below and get the full-text PDF.
 
 
And don't miss our blog updates! Follow us on [Twitter](https://twitter.com/TeamT5_Official).

TeamT5 Information Operation White Paper III: China’s Social Manipulation outside the Great Firewall

# Why should you read this article?
China presents an enormous influence on the cyber threat landscape of the Asia-Pacific region. By analyzing China's cyberspace and regulatory state, one may catch a glimpse of the underlying shift of the cyber ecosystem and threat actors' TTPs and motivations. In this article, our analysts summarized the key incidents that shape China's cyberspace in 2021 and propose some outlooks for future development.
 

## Key Takeaways
1.	2021 was a significant year for Chinese cyberspace, as it marked the start of China's 14th Five-Year Plan (2021-2025). In 2021, China had launched a sweeping tech crackdown and accelerated consolidation of power in reigning everything within the Great Firewall (GFW).
2.	The Chinese regulators had taken high-profile actions against major tech companies, especially those operating social media and commerce platforms. Firms like Alibaba, ByteDance, Tencent, Didi Chuxing, and Meituan have faced record fines and cybersecurity probes. In contrast, "hard tech" companies in strategically critical sectors like Huawei and SMIC have been mainly exempted from regulatory scrutiny.
3.	The Chinese regulators, led by the Cyberspace Administration of China (CAC), introduced and amended a series of regulations to tighten their control over the management and flow of data. The new rules range from privacy protection and data transfer to vulnerabilities disclosure.
4.	International technology firms also faced pressures and censorship from the Chinese regulators. Famous apps like Clubhouse, Signal, and Quran Majeed have been reportedly blocked in China. Besides, companies like LinkedIn and Yahoo have pulled out of China, citing a challenging environment.
5.	With China's expansion of power over cyberspace, stakeholders and cybersecurity practitioners should stay vigilant to their network and asset exposure to China's jurisdiction. Besides, we have observed that China's regulatory campaign were often followed by covert cyber operations. Indicators have shown that 2022 will undoubtedly be another challenging year for Chinese and international tech giants.

# Overview: A Year of Tech Crackdown

2021 was a significant year for Chinese cyberspace, as it marked the start of China's 14th Five-Year Plan (2021-2025). One of the strategy’s ambitions is to tackle monopolies and review regulations related to the digital economy. Over the past year, the Chinese regulators had taken high-profile actions against major tech companies, especially those operate social media and commerce platforms. Prior to 2021, the relationships between the Chinese authorities and the country’s tech giants have been complex and in flux. For many years, the tech regulators had turned a blind eye to some illegal business practices, anti-competitive acts, and tax evasion of the tech giants, because these companies have brought China robust economic growth. However, in 2021, the Chinese regulators had taken high-profile actions against companies including Alibaba, ByteDance, Tencent, Didi Chuxing, and Meituan, levying record-high fines as well as imposing cybersecurity probes and a six-month rectification program. Companies in online gaming, private tutoring, and cryptocurrency were also among the casualties.

What is notable is that all the regulations and probes are directed at the consumer technology sector, rather than “hard tech” companies that are considered by China as strategically critical sectors, such as semiconductor, new materials, new energy, and aeronautics. Therefore, companies Huawei and Semiconductor Manufacturing International Corporation (SMIC) are largely exempted from regulatory scrutiny.

On the other hand, the Chinese regulators, led by the Cyberspace Administration of China (CAC), had introduced and amended a series of regulations to tighten their control over the management and flow of data. For instance, the CAC has implemented the Data Security Law that restricts cross-border data transfers as well as the Personal Information Protection Law which governs data privacy protection. The latter is also regarded as China’s version of the EU’s General Data Protection Regulation (GDPR). Meanwhile, the CAC also announced a new vulnerability disclosure regulation that requires vendors to share vulnerability reports with state agencies within two days. Because of the new law, Alibaba Cloud has faced punishment for not reporting the most serious vulnerability in recent years, Log4Shell, to the Chinese authorities in the first place.

# A More Difficult Environment for Domestic and International Tech Firms

International technology firms also faced pressures and censorship from the Chinese regulators. Famous apps like Clubhouse and Signal have been reportedly blocked in China, as these services allow the online users to exchange ideas without being censored by the Chinese government or Chinese social media platforms. Quran Majeed, a popular app among the Muslim community, was also banned in China, signaling more oppression against the Chinese Uyghurs. Besides, companies like LinkedIn and Yahoo have pulled out of China, citing challenging environment. The abovementioned incidents have indicated that 2022 is very likely to be another difficult year for both domestic and international tech firms.

The following timeline have summed up China’s actions in reigning in the country’s cyberspace in 2021.

# Abbreviations

```
CCP: Chinese Communist Party

CAC: Cyberspace Administration of China

MIIT: Ministry of Industry and Information Technology

SAMR: State Administration for Market Regulation```


# Timeline
## 2021Q1
**January**

- SAMR launched antitrust investigation into Alibaba
- CAC issued a new law to regulate public accounts to combat disinformation and fake traffic



**February**

- SAMR finalized anti-monopoly guidelines
- MIIT drafted new regulations to combat excessive data collection by mobile apps
- US audio-chat app Clubhouse reportedly blocked in China



**March**

- CCP's Two Sessions 2021
- SAMR fined 10 big tech firms for failing to report acquisitions
- CAC issued new rules to tighten supervision over big tech’s collection of user data
- Encrypted messaging app Signal reportedly blocked in China


## 2021Q2
**April**

- SAMR imposed record US$2.8 Billion fine against Alibaba
- CAC launches hotline for netizens to report “illegal” history comments
- SAMR announced investigation into delivery giant Meituan
- CCP reviewed “Data Security Law” and “Personal Information Protection Law”
- CAC issue draft rules on users’ privacy protection of mobile apps



**May**

- CAC called out 84 apps Including Tencent, Alibaba, and Baidu for violating user privacy



**June**

- CCP Passed “Data Security Law” and “Anti- Foreign Sanctions Law”
- China widens cryptocurrency crackdown: mining projects shut down; banks ordered to step up clampdown


## 2021Q3
**July**

- CAC banned Didi Chuxing’s apps after its U.S. IPO
- CAC to amend “Cybersecurity Review Regulations,” tightening controls over foreign-listed firms
- CAC issued new vulnerability disclosure rules
- MIIT launched 6-month rectification program, ordering tech firms to fix anticompetitive, security issues
- 7 Chinese agencies sent officials to conduct on-site cybersecurity inspections at Didi Chuxing



**August**

- Chinese state media labeled online gaming “spiritual opium” and called out Tencent
- CAC drafted "Personal Information Protection Law"
- CAC launched regulations to protect critical information infrastructure
- China orders state firms to migrate to government cloud services



**September**

- CAC launched “Security Threat Information Sharing Platform” for reporting vulnerabilities
- CAC ruled all crypto-related transactions illegal


## 2021Q4
**October**

- LinkedIn shut down operation in China as compliance challenges increase
- CAC banned cross border transfer of core industrial and telecoms data
- China bans Quran Majeed, one of the most popular Quran apps in the world



**November**

- Personal Information Protection Law (PIPL) took effect
- Yahoo pulled out of China, citing 'challenging' environment
- China suspended Tencent apps update and limiting use in state-run firms
- China to ban business use of WeChat and Alipay personal payment QR codes
- China censored tennis star Peng Shuai over sexual assault claims against CCP high-ranking official



**December**

- CAC issued rules to block foreign religious content online
- MIIT suspended cooperation with Alibaba Cloud, citing delayed report of Log4j2 vulnerability
- Didi Global delisted from the NYSE
- CAC fined Weibo for publishing illegal information


# Outlook: China's Endless Pursuit of Cyber Power and Regulatory Control
So far, there is no indication that the Chinese government will loosen up its grip over the tech firms. With China’s expansion of power over cyberspace, stakeholders and cybersecurity practitioners should stay vigilant to the exposure of their network and asset to China’s jurisdiction. On the other hand, we have observed that China's regulatory campaign were often followed by covert cyber operations. For instance, our telemetry had previously detected that China-nexus Advanced Persistent Threat (APT) groups targeted companies and organizations which were on the list of China's anti-corruption campaign.

The political landscape in China heavily influences the country's strategy in reigning its cyberspace. In August 2022, the Chinese Communist Party (CCP) will be hosting its 20th Party Congress, where the party’s leadership and policy agenda for the next five years will be announced. It is no surprise that the Chinese authorities will continue the enforcement actions, furthering tech crackdown under the name of “common prosperity” and consolidating the state’s position as the country’s most powerful cyber player.



*Image courtesy of [Pixabay](https://pixabay.com/)

China’s Cyber Power Intel Roundup 2021: Tech Crackdown, Regulatory Storm, and Power Expansion

> 中國對亞太地區的網路環境具有極高度影響力。透過分析中國的網路空間與監管作法，人們得以瞥見中國網路生態系的轉變，及網路攻擊行動者的動機與所使用之戰術、技術與流程（tactics, techniques, and procedures, TTP）。本文中，TeamT5 資安威脅情資分析師團隊總結形塑了2021年中國網路空間的關鍵事件，並提出對未來發展態勢的看法。

# Why should you read this article?
China presents an enormous influence on the cyber threat landscape of the Asia-Pacific region. By analyzing China's cyberspace and regulatory state, one may catch a glimpse of the underlying shift of the cyber ecosystem and threat actors' TTPs and motivations. In this article, our analysts summarized the key incidents that shape China's cyberspace in 2021 and propose some outlooks for future development.

## Key Takeaways
1.	2021 was a significant year for Chinese cyberspace, as it marked the start of China's 14th Five-Year Plan (2021-2025). In 2021, China had launched a sweeping tech crackdown and accelerated consolidation of power in reigning everything within the Great Firewall (GFW).
2.	The Chinese regulators had taken high-profile actions against major tech companies, especially those operating social media and commerce platforms. Firms like Alibaba, ByteDance, Tencent, Didi Chuxing, and Meituan have faced record fines and cybersecurity probes. In contrast, "hard tech" companies in strategically critical sectors like Huawei and SMIC have been mainly exempted from regulatory scrutiny.
3.	The Chinese regulators, led by the Cyberspace Administration of China (CAC), introduced and amended a series of regulations to tighten their control over the management and flow of data. The new rules range from privacy protection and data transfer to vulnerabilities disclosure.
4.	International technology firms also faced pressures and censorship from the Chinese regulators. Famous apps like Clubhouse, Signal, and Quran Majeed have been reportedly blocked in China. Besides, companies like LinkedIn and Yahoo have pulled out of China, citing a challenging environment.
5.	With China's expansion of power over cyberspace, stakeholders and cybersecurity practitioners should stay vigilant to their network and asset exposure to China's jurisdiction. Besides, we have observed that China's regulatory campaign were often followed by covert cyber operations. Indicators have shown that 2022 will undoubtedly be another challenging year for Chinese and international tech giants.

# Overview: A Year of Tech Crackdown
2021 was a significant year for Chinese cyberspace, as it marked the start of China's 14th Five-Year Plan (2021-2025). One of the strategy’s ambitions is to tackle monopolies and review regulations related to the digital economy. Over the past year, the Chinese regulators had taken high-profile actions against major tech companies, especially those operate social media and commerce platforms. Prior to 2021, the relationships between the Chinese authorities and the country’s tech giants have been complex and in flux. For many years, the tech regulators had turned a blind eye to some illegal business practices, anti-competitive acts, and tax evasion of the tech giants, because these companies have brought China robust economic growth. However, in 2021, the Chinese regulators had taken high-profile actions against companies including Alibaba, ByteDance, Tencent, Didi Chuxing, and Meituan, levying record-high fines as well as imposing cybersecurity probes and a six-month rectification program. Companies in online gaming, private tutoring, and cryptocurrency were also among the casualties.

What is notable is that all the regulations and probes are directed at the consumer technology sector, rather than “hard tech” companies that are considered by China as strategically critical sectors, such as semiconductor, new materials, new energy, and aeronautics. Therefore, companies Huawei and Semiconductor Manufacturing International Corporation (SMIC) are largely exempted from regulatory scrutiny.

On the other hand, the Chinese regulators, led by the Cyberspace Administration of China (CAC), had introduced and amended a series of regulations to tighten their control over the management and flow of data. For instance, the CAC has implemented the Data Security Law that restricts cross-border data transfers as well as the Personal Information Protection Law which governs data privacy protection. The latter is also regarded as China’s version of the EU’s General Data Protection Regulation (GDPR). Meanwhile, the CAC also announced a new vulnerability disclosure regulation that requires vendors to share vulnerability reports with state agencies within two days. Because of the new law, Alibaba Cloud has faced punishment for not reporting the most serious vulnerability in recent years, Log4Shell, to the Chinese authorities in the first place.

# A More Difficult Environment for Domestic and International Tech Firms

International technology firms also faced pressures and censorship from the Chinese regulators. Famous apps like Clubhouse and Signal have been reportedly blocked in China, as these services allow the online users to exchange ideas without being censored by the Chinese government or Chinese social media platforms. Quran Majeed, a popular app among the Muslim community, was also banned in China, signaling more oppression against the Chinese Uyghurs. Besides, companies like LinkedIn and Yahoo have pulled out of China, citing challenging environment. The abovementioned incidents have indicated that 2022 is very likely to be another difficult year for both domestic and international tech firms.

The following timeline have summed up China’s actions in reigning in the country’s cyberspace in 2021.

# Abbreviations

```
CCP: Chinese Communist Party

CAC: Cyberspace Administration of China

MIIT: Ministry of Industry and Information Technology

SAMR: State Administration for Market Regulation```


# Timeline
## 2021Q1
**January**

- SAMR launched antitrust investigation into Alibaba
- CAC issued a new law to regulate public accounts to combat disinformation and fake traffic



**February**

- SAMR finalized anti-monopoly guidelines
- MIIT drafted new regulations to combat excessive data collection by mobile apps
- US audio-chat app Clubhouse reportedly blocked in China



**March**

- CCP's Two Sessions 2021
- SAMR fined 10 big tech firms for failing to report acquisitions
- CAC issued new rules to tighten supervision over big tech’s collection of user data
- Encrypted messaging app Signal reportedly blocked in China


## 2021Q2
**April**

- SAMR imposed record US$2.8 Billion fine against Alibaba
- CAC launches hotline for netizens to report “illegal” history comments
- SAMR announced investigation into delivery giant Meituan
- CCP reviewed “Data Security Law” and “Personal Information Protection Law”
- CAC issue draft rules on users’ privacy protection of mobile apps



**May**

- CAC called out 84 apps Including Tencent, Alibaba, and Baidu for violating user privacy



**June**

- CCP Passed “Data Security Law” and “Anti- Foreign Sanctions Law”
- China widens cryptocurrency crackdown: mining projects shut down; banks ordered to step up clampdown


## 2021Q3
**July**

- CAC banned Didi Chuxing’s apps after its U.S. IPO
- CAC to amend “Cybersecurity Review Regulations,” tightening controls over foreign-listed firms
- CAC issued new vulnerability disclosure rules
- MIIT launched 6-month rectification program, ordering tech firms to fix anticompetitive, security issues
- 7 Chinese agencies sent officials to conduct on-site cybersecurity inspections at Didi Chuxing



**August**

- Chinese state media labeled online gaming “spiritual opium” and called out Tencent
- CAC drafted "Personal Information Protection Law"
- CAC launched regulations to protect critical information infrastructure
- China orders state firms to migrate to government cloud services



**September**

- CAC launched “Security Threat Information Sharing Platform” for reporting vulnerabilities
- CAC ruled all crypto-related transactions illegal


## 2021Q4
**October**

- LinkedIn shut down operation in China as compliance challenges increase
- CAC banned cross border transfer of core industrial and telecoms data
- China bans Quran Majeed, one of the most popular Quran apps in the world



**November**

- Personal Information Protection Law (PIPL) took effect
- Yahoo pulled out of China, citing 'challenging' environment
- China suspended Tencent apps update and limiting use in state-run firms
- China to ban business use of WeChat and Alipay personal payment QR codes
- China censored tennis star Peng Shuai over sexual assault claims against CCP high-ranking official



**December**

- CAC issued rules to block foreign religious content online
- MIIT suspended cooperation with Alibaba Cloud, citing delayed report of Log4j2 vulnerability
- Didi Global delisted from the NYSE
- CAC fined Weibo for publishing illegal information


# Outlook: China's Endless Pursuit of Cyber Power and Regulatory Control
So far, there is no indication that the Chinese government will loosen up its grip over the tech firms. With China’s expansion of power over cyberspace, stakeholders and cybersecurity practitioners should stay vigilant to the exposure of their network and asset to China’s jurisdiction. On the other hand, we have observed that China's regulatory campaign were often followed by covert cyber operations. For instance, our telemetry had previously detected that China-nexus Advanced Persistent Threat (APT) groups targeted companies and organizations which were on the list of China's anti-corruption campaign.

The political landscape in China heavily influences the country's strategy in reigning its cyberspace. In August 2022, the Chinese Communist Party (CCP) will be hosting its 20th Party Congress, where the party’s leadership and policy agenda for the next five years will be announced. It is no surprise that the Chinese authorities will continue the enforcement actions, furthering tech crackdown under the name of “common prosperity” and consolidating the state’s position as the country’s most powerful cyber player.


*圖片來源: [Pixabay](https://pixabay.com/)



中國網路威脅之2021年情資綜述: 打壓科技巨頭、監管風暴、權力擴張

# この記事を読んでおきたい理由
中国は、アジア太平洋地域のサイバー脅威の状況に大きな影響を及ぼしています。中国のサイバースペースと規制状況を分析することで、サイバーエコシステムの根本的な変化を知り、脅威アクターのTTPや動機を垣間見ることができます。本記事では、2021年の中国のサイバースペースを形成した重要なインシデントをまとめており、今後の展開についてもいくつかの展望を提案しています。
 

## 重要な事項
1.	2021年は、中国の第14次5カ年計画（2021～2025年）が開始する年でもあり、中国のサイバースペースにとって重要な年でした。2021年、中国はグレートファイアウオール（GFW）の中にすべてをおさめるため、徹底的な技術取り締まりを実施し、権力をさらに強化させました。
2.	中国の規制当局は、大手ハイテク企業、特にソーシャルメディアやコマースプラットフォームを運営する企業に対して、注目度の高い措置を取りました。Alibaba、ByteDance、Tencent、Didi Chuxing、Meituanなどの企業が、記録的な罰金とサイバーセキュリティの調査に直面しました。それに対して、HuaweiやSMICなどの戦略的に重要な分野に属する「ハードテック」企業の多くは、規制当局の監視から免除されました。
3.	中国サイバースペース管理局（CAC）を中心とした中国の規制当局は、データの管理と流れの管理を強化すべく、一連の規制を導入し、修正を行いました。新しい規則は、プライバシー保護やデータ転送、脆弱性の開示など多岐にわたるものです。
4.	また、国際的なテクノロジー企業も中国の規制当局からの圧力や検閲に直面しました。Clubhouse、Signal、Quran Majeedなどの有名なアプリが中国でブロックされたことが繰り返し報じられました。その他にも、LinkedInやYahooなどの企業が、厳しい環境を理由に中国から撤退しています。
5.	中国のサイバースペースにおける力が拡大する中、関係者やサイバーセキュリティ専門家は、中国の司法権にさらされるネットワークや資産を慎重に扱う必要があります。それだけではなく、中国の規制キャンペーンの後には、秘密のサイバー作戦が後続する傾向にあることもわかっています。2022年も、中国や世界のハイテク企業にとって厳しい年になることは間違いない兆候にあります。


# 概要：技術取り締まりが多発した年

2021年は、中国の第14次5カ年計画（2021～2025年）が開始する年でもあり、中国のサイバースペースにとって重要な年でした。この戦略の目的の1つが、独占事業への取り組みとデジタル経済に関連した規制の見直しです。この1年にわたって、中国の規制当局は、大手ハイテク企業、特にソーシャルメディアやコマースプラットフォームを運営する企業に対して、注目度の高い措置を取りました。2021年までは、中国当局と同国の技術系最大手企業との関係は複雑で流動的なものでした。長年にわたり、規制当局はこういった企業の違法なビジネス行為、反競争的行為、脱税などの行為に対して目をつぶってきました。なぜなら、技術系企業が中国に強固な経済成長をもたらしていたからです。しかしながら、2021年、中国の規制当局は、Alibaba、ByteDance、Tencent、Didi Chuxing、Meituanなどの企業に対して、過去最高額の罰金を課すとともに、サイバーセキュリティの調査や6ヶ月の是正プログラムを課すなど、注目を集める措置をとりました。オンラインゲーム、家庭教師、暗号通貨などを運営する企業も犠牲となりました。

注目すべきは、すべての規制や調査が、半導体、新素材、新エネルギー、航空などの中国が戦略的に重要と考える「ハードテック」企業ではなく、消費者向け技術分野に向けられている点です。そのため、HuaweiやSemiconductor Manufacturing International Corporation（SMIC）といった企業は、規制当局の監視対象からほとんど除外されています。

一方で、中国サイバースペース管理局（CAC）を中心とした中国の規制当局は、データの管理と流れの管理を強化すべく、一連の規制を導入し、修正を行いました。例えば、CACは、国境を越えたデータ転送を制限するデータセキュリティ法や、データプライバシー保護を規定する個人情報保護法を執行しました。個人情報保護法は、EUの一般データ保護規則（GDPR）の中国版とも位置づけられています。それと同時に、CACはベンダーに対して2日以内に脆弱性レポートを州当局と共有することを義務付ける、新しい脆弱性開示規制も発表しました。この新しい法律により、Alibaba Cloudは、近年で最も深刻な脆弱性であるLog4Shellを第一に中国当局に報告しなかったことで処分されました。

# 国内外の技術系企業にとって環境が厳格化

また、国際的なテクノロジー企業も中国の規制当局からの圧力や検閲に直面しました。ClubhouseやSignalなどの有名なアプリが中国で繰り返しブロックされています。これらのサービスでは、中国政府や中国のソーシャルメディアプラットフォームの検閲を受けることなく、オンラインユーザーが意見を交換することができるからです。イスラム教徒の間で人気のアプリであるQuran Majeedも中国で禁止され、中国のウイグル人に対する弾圧がさらに強まる兆候にあります。その他にも、LinkedInやYahooなどの企業が、厳しい環境を理由に中国から撤退しています。上述のようなインシデントから、2022年も国内外の技術系企業にとって厳しい年となる可能性が非常に高いことがわかります。

以下の年表は、2021年度に中国がサイバースペースに影響を及ぼした行動をまとめたものです。

# 略語

```
CCP: 中国共産党

CAC: 中国サイバースペース管理局

MIIT: 中華人民共和国工業情報化部

SAMR: 国家市場監督管理総局```


# 年表
## 2021Q1
**1月**

- SAMRがAlibabaへの独占禁止法調査を開始
- CACが偽情報と偽トラフィックに対抗するため、公会計を規制する新法を発表




**2月**

- SAMRが独占禁止法ガイドラインを成立
- MIITがモバイルアプリによる過度なデータ収集に対処するための新たな規制を立案
- 米国のオーディオチャットアプリ「Clubhouse」が中国でブロックされたと報道あり




**3月**

- CCPのTwo Sessions 2021
- SAMRが買収を報告しなかった大手技術系企業10社に罰金の支払いを命令
- CACが、大手ハイテク企業によるデータ収集への監督を強化するため新規則を発表
- 暗号化メッセージアプリ「Signal」が中国でブロックされたと報道あり



## 2021Q2
**4月**

- SAMRがAlibabaに過去最高の28億ドルの罰金の支払いを命令
- CACはネットユーザーが「違法な」履歴コメントを報告することができるホットラインを開設
- SAMRが宅配大手企業「Meituan」に対する調査を発表
- CCPが「データセキュリティ法」と「個人情報保護法」の見直しを実施
- CACがモバイルアプリ利用者のプライバシー保護に対する規則の草案を発表




**5月**

- CACはTencent、Alibaba、Baiduなどの84個のアプリがユーザーのプライバシーを侵害しているとして摘発




**6月**

- CCPが「データセキュリティ法」と「反外国人制裁法」を可決
- 中国が暗号通貨の取り締まりを拡大。マイニングプロジェクトが閉鎖され、銀行に取締りを強化するよう要請


## 2021Q3
**7月**

- CACが米国IPO後にDidiChuxingのアプリを禁止IPO
- CACが「サイバーセキュリティ審査規則」を改正し、外国上場企業に対する規制を強化
- CACが脆弱性開示に関する新規則を発表
- MIITが6か月の修正プログラムを開始し、技術系企業に反競争的なセキュリティの問題を修正するように命令
- 7つの中国の機関が、Didi Chuxingでサイバーセキュリティ検査を実施するために職員を派遣




**8月**

- 中国の国営メディアがオンラインゲームを「精神面に影響するアヘン」と名付け、Tencentを非難
- CACが「個人情報保護法」を起草
- CACが重要な情報インフラストラクチャを保護するための規制を制定
- 中国が国営企業に政府のクラウドサービスへの移行を命令




**9月**

- CACが脆弱性を報告するための「セキュリティ脅威情報共有プラットフォーム」を発表
- CACがすべての暗号関連の取引を違法と判断



## 2021Q4
**10月**

- LinkedInがコンプライアンスの課題が増えたことを理由に中国での事業を停止
- CACが主要な産業や電気通信データの国境を越えた転送を禁止
- 中国は、世界で最も人気のあるコーランアプリの1つであるQuran Majeedを禁止




**11月**

- 「個人情報保護法」（PIPL）の施行を開始
- Yahooが「困難な」環境を理由に中国から撤退
- 中国がTencentアプリの更新を一時停止し、国営企業のみでの使用に制限
- 中国がビジネスでのWeChatとAlipayの個人決済QRコードの使用を禁止
- 中国が、CCPの高官に対する性的暴行の主張をめぐってテニススターの彭帥を検閲




**12月**

- CACが外国からの宗教的なオンラインコンテンツをブロックするための規則を発表
- MIITは、Log4j2の脆弱性の報告が遅れたことを理由に、Alibaba Cloudとの提携を停止
- Didi Globalがニューヨーク証券取引所から上場廃止
- CACが違法な情報を公開したとしてWeiboに罰金の支払いを命令



# 展望：中国はサイバーパワーと規制管理を際限なく追求
今のところ、中国政府が技術系企業への管理を緩和させる気配はありません。中国のサイバースペースにおける力が拡大する中、関係者やサイバーセキュリティ専門家は、中国の司法権にさらされるネットワークや資産を慎重に扱う必要があります。またその一方で、中国の規制キャンペーンの後には、秘密のサイバー作戦が後続する傾向にあることもわかっています。例えば、当社のテレメトリーは、中国関連のAPT（Advanced Persistent Threat）グループが、中国の腐敗防止キャンペーンのリストに載っている企業や組織を標的にしていることを以前に検出しています。

中国の政治状況は、サイバースペースを支配する中国の戦略に大きく影響します。2022年8月には、中国共産党（CCP）が第20回党大会を開催します。ここで、今後5年間の党指導部と政策アジェンダが発表される予定です。中国当局が取締りを継続し、「共同繁栄」の名の下に技術取り締まりをさらに強化して、国内最強のサイバープレイヤーとしての国家の地位を固めたとしても驚くにはあたらないでしょう。



*画像のソース: [Pixabay](https://pixabay.com/)

TeamT5 發布了〈資訊戰白皮書：2020台灣大選觀察〉

1. 假新聞讓各政黨支持者成為可能的散播源

2. 假新聞的手法與目標持續地改變

3. 中國持續加大自己的影響力

4. 假新聞的攻擊行動被層層外包

Related Post

TeamT5〈資訊戰白皮書二部曲：中國防火長城內的數位政治宣傳〉

TeamT5〈資訊戰白皮書三部曲：中國的社群操弄〉

中國網路威脅之2021年情資綜述: 打壓科技巨頭、監管風暴、權力擴張