Beijing clamping down on use of VPNs to evade Great Firewall

A woman reacts near a booth promoting overseas marketing services on Facebook and Instagram, which are banned in China, during an internet conference in Beijing

China is tightening control over foreign companies’ internet use in a move some worry might disrupt their operations or jeopardize trade secrets as part of a crackdown on technology that allows web surfers to evade Beijing’s online censorship.

In a letter to corporate customers seen by The Associated Press, the biggest Chinese internet service provider says virtual private networks, which create encrypted links between computers and can be used to see sites blocked by Beijing’s web filters, will be permitted only to connect to a company’s headquarters abroad. The letter from state-owned China Telecom Ltd. says VPN users are barred from linking to other sites outside China, a change that might block access to news, social media or business services that are obscured by its “Great Firewall.”

The letter repeats an announcement from January that only VPNs approved by Chinese authorities are allowed. That has prompted fears of possible loss of trade secrets or information about customers or employees among companies that question the reliability of Chinese encryption services and whether authorities might read messages.

Regulators announced a crackdown in January to stamp out use of VPNs to circumvent web censorship.

Authorities have tried to reassure companies they won’t be affected, but if the rules in the China Telecom letter are enforced, they could hamper activity ranging from gathering information for business deals to employees working on business trips.

The crackdown reflects President Xi Jinping’s vision of “internet sovereignty,” or Beijing’s absolute right to control what people can do and see online.

Control over information is especially sensitive ahead of a party congress late this year at which Xi is due to be appointed to a second five-year term as leader.

The ruling Communist Party encourages web use for business and education but rejects the notion of a borderless internet and the free flow of information. It controls internet traffic across China’s borders and tries to keep its public from seeing thousands of websites abroad including Google and social media such as Facebook, Twitter and YouTube, as well as news outlets and human rights groups.

This week, the Beijing municipal internet regulator announced it ordered website operators including Baidu Inc. and Tencent Holdings Ltd. to remove material that was “distorting the history of China and the Party” and “promoting abnormal values” or had other problems.

Also this week, a letter issued by the Waldorf Astoria Hotel in Beijing to guests that circulated on social media says the hotel can no longer provide VPN service “due to legal issues” as of last Friday.

In June, the Hong Kong-based operator of a popular service, Green VPN, announced Chinese regulators had ordered it to close.

Beijing has repeatedly pressured foreign companies to hand over technology, encryption know-how and other trade secrets in exchange for access to its huge and growing market.

Companies cite internet controls as among the biggest obstacles to doing business in China.

In a survey by the American Chamber of Commerce in China last year, 79 percent of companies that responded said web filters hurt them by blocking access to information and business tools.

U.S. President Donald Trump said in April he would temporarily set aside disputes with Beijing over market barriers and currency while the two sides cooperated over North Korea’s nuclear program. But Trump has expressed frustration with lack of progress on that and has resumed criticizing China’s trade surplus with the United States.

It was unclear how many companies received China Telecom’s letter. The American and European Chambers of Commerce in Beijing said their members had not reported receiving it.

The letter, which bears no date, says VPNs are for “internal office use only” and only can connect to a company’s headquarters abroad, not to any other websites. That would block users from seeing business news or other information sources that are shielded by the filters.

Companies are required to provide the identities of every employee who uses a VPN, according to the letter.

Lester Ross, a lawyer in Beijing for the firm WilmerHale, said he had not heard of the China Telecom letter. But he said the conditions in it described to him by a reporter would be disruptive if enforced.

Without VPNs to bypass web filters, “then it is just impossible to do business under the constraints that apply officially,” said Ross. “You’re either making it unenforceable or they are damaging business to an extraordinary extent.”

A Western diplomat who asked not to be identified further due to the sensitivity of the issue said companies have told his government they worry the controls might lead to weaker data security and trade secrets being leaked to Chinese competitors. The diplomat said some are hesitant to invest more in China due to that.

China Telecom and the Ministry of Industry and Information Technology, which announced the January crackdown, did not respond to requests for information about the letter.

Authorities have never disclosed whether they read communications sent over Chinese VPN providers.

“Despite the fact that people get used to the system, protection of confidentiality is always a concern,” said Ross. “They’ve never guaranteed privacy of communications.”

Beijing has announced restrictions on VPN use over the past decade but did little to enforce them, possibly to avoid disrupting business or access to information for scientists and academics.

The VPN crackdown coincides with a Cybersecurity Law that took effect on June 1 and tightens control over data. It limits use of foreign security technology and requires companies to store information about Chinese citizens within this country.

On Tuesday, users of Facebook’s WhatsApp messaging service, which normally operates freely in China, were no longer able to send images without using a VPN. That coincided with official efforts to suppress mention of Liu Xiaobo, the imprisoned Nobel Peace laureate who died last week and whom social media users have commemorated by exchanging images of him.

Already, companies increasingly limit VPN access to employees such as media managers “with a critical business need” to see a banned website, according to Jake Parker, vice president of China operations for the U.S.-China Business Council.

Companies can avoid the need for a VPN by leasing a circuit from China Telecom or other state-owned providers that connects directly to their headquarters abroad. Prices start at more than USD1,000 per month.

The information ministry tried to reassure commercial users in a statement reported last week in a Shanghai newspaper, The Paper.

“Foreign trade enterprises and multinational companies that need a cross-border line for their own office use can lease one from an authorized telecoms enterprise,” said the statement. It said the January notice “will not affect normal operations.” Joe McDonald, Beijing, AP