Google and China: Interesting Times?

So what do we think about the Google China affair then? For anyone who has been hiding under a rock on Pluto lately, Google announced on January 13th that it "may end its operations in China following a "sophisticated and targeted" cyber attack originating from the country." aimed apparently at gathering intelligence from Gmail accounts etc on human rights activits, dissidents and the like in China, and adding that in response they would no longer self censor their search database as they had since starting up in China in 2006. China, unsurprisingly, insisted that hacking was illegal in China and Google would have to toe the line and enforce local laws like other companies. Then perhaps slightly more surprisingly, the US government itself got involved in the form of a swinging speech by Hilary Clinton demanding that Beijing that should investigate the hack attacks on Google, and les directly, implying that China had a duty, like also-mentioned Tunisia, Uzbekistan, Vietnam and Egypt to stop restricting freedom of expression on the Internet. One commentator has compared this to Reagan demanding the pulling down of the Berlin Wall - only this time it was the Chinese Great Firewall. For China to back down wouldbe almost unprecedented; so at least China insider has said that in six months he expects there to be no Google.cn. Meanwhile information filters out that similar espionage hacks seem to have been mounted by Chinese hackers on other US companies in recent months , seeking economic espionage intelligence; two of the companies were major US oil companies.

The main response to this has been huzzah! In a world apparently dominated by bankers taking as many undeserved bonuses as they can sweep up, one can sense the eagernness of the world to believe that a big company can still want to do the right thing. Certainly even if Google's "Do no evil" motto has tarnished a little lately they do stand out as appearing in the world of corporate politics to give a damn about human rights. A Grauniad columnist wrote perhaps a little over excitedly yesterday:
"

we can now again unreservedly identify, politically as well as aesthetically, with Google. This is the spirit of liberal universalism. It says that there are some universal rights it is not the prerogative of any state or "civilisation" to curb; and that, as the Universal Declaration of Human Rights states, the right to information freedom is among them."

But is anything in life really this simple? As many have pointed out, China is a market where Google is not dominant, having only around 30% of the market. But pulling out of the world's largest emergent economy is still rather a bold step. Unless perhaps you consider the rather less publicised fact that Google only makes money by click through on ads; and reportedly, the Chinese don't yet bother to click through (Google don't reveal the turnover of their Chinese business as they do their US profits). Still it seems like either a very brave or a very foolhardy endeavour. (Bill Thompson comments that "Threatening to pull out of China is like threatening to spit on a whale".) (Unless you think it's all merely a very successful PR stunt.)

A braver woman than Pangloss might even sail into the world of conspiracy theories, and consider the Google response and the Clinton speech as part of a combined PR drive. China expert Orville Schell in this video recorded at Davos, notes that

"Google has become more like a nation than a company. By this he means that not only is Google closely connected to the Obama administration, but the company has a high resonance in the western world. Only a company like Google could take such a stance against China".

Why would the US want Google out of China, or at least, a very public fuss about the hack attacks on Gmail accounts by China? Well cybersecurity experts have long privately admitted that although rather more fuss has been publicly made about "cyberwar" denial of service attacks on critical infrastructure (as , famously, against Estonian and Georgian banks and media sites, etc), the foremost worry is actually about cyber espionage. Chinese keylogger code has been found before now on military computers; it is known that it is almost impossible to 100% protect against this. Google store invaluable information not just about Chinese dissidents but US citizens - and companies. If you were a Chinese espionage officer would you target the unprotected Gmail user or the more protected Google servers, or the very well protected servers carrying confidential military or corporate secrets?

For a cyber lawyer, the interest here is whether we are approaching the point where cyber espionage might begin to be characterised as "cyberwar". Just as with DDOS attacks, the current law is badly equippd, perhaps quite properly, to make this conceptual leap. I spoke on this in Estonia last summer, at the NATO backed CyberSecurity Centre. International treaties demand an "armed attack" by a "state" before rights of self defence or international humanitarian law can begin to apply. Is use of code to find out information an "armed attack"? Difficult to see (although there was some discussion of this back in the good ol' days of Star Wars defence.)

More significant still is the pained matter of attribution. No one can prove that attacks by Chinese hackers came from and with the authority of the Beijing government - and circumstantial evidence simply cannot be regarded as decisive here given the easy obfuscation of Internet traffic and addresses, and the flourishing private enterprise cyber black market. Much of the cybercrime in the world originates from networks of zombie machines run (apparently:-) by Russians with the machines scattered through every country from the UK to Brazil; this does not mean (necessarily) that Russia, the UK or Brazil is responsible as a state aggressor. The question of attribution will have to be far better discussed before we can go any further down this line. In the meantime however, it is interesting to note that there are reported American stirrings of interest in a cyberwar treaty to reduce cyber-attacks, as with munitions or poison gas weapons: such a treaty has long been resisted by the US, but now that position seems to be shifting - why?*

And meanwhile today brave little Twitter, hero of the Iran dissidents, announces they are sub contracting research to avoid being blocked by China. All in all very interesting times - in the Chinese sense?

*Well perhaps because as I discover the minute I finish writing this, 37% of US critical infrastructure firms think cyber attacks are growing and 2/5 expct a majot cyber security incient within the year - say McAfee at Davos.

Lisbon Treaty We Salute You

I almost thought I would never live to see the day but yes the Lisbon Treaty has cleared its final hurdle and will become European law possibly in December 2009.

It's all rather a damp squib for a UK privacy lawyer though. (Even one who is healthily sceptical that the Tories can get us out of this one, even when they do get in.) Pangloss's main interest was in wondering if the EU Charter's explicit addition of a right to protection of personal data as well as the well known right to respect for private life (cf Art 8, ECHR) might make a difference and if so, in what way. However for we delicate flowers of the UK and Poland, there will be no change on the human rights front: see Art 1 -

In particular, and for the avoidance of doubt, nothing in Title IV of the Charter creates justiciable rights applicable to Poland or the United Kingdom except in so far as Poland or the United Kingdom has provided for such rights in its national law.

Pangloss is sadly no EU law nerd, and would welcome comment from any such out there as to whether this means we are in any way likely to receive less comprehensive privacy protection than the rest of the EU? Examples? This seems particularly relevant given the general feeling that the UK is implementing EC DP law at the minimum or below : see the EU's continuing efforts to persuade the UK to buck up over Phorm, not to mention long-simmering confusion or dismay over (a) Durant v FSA and (b) relatedly, our lack of sync with the Art 29 WP as to when and if to treat IP addresses as personal data.

It also of course means the UK remains unbound, at least in theory, by Article 36 of the Charter of Rights on Access to services of general economic interest. So no danger of the UK fast following in the footsteps of Finland and declaring access to broadband a human right? Surprising, that :-)

However before we Anglo-Saxons despair, we should remember the guidance from the ECJ in Promusicae which indicated that whether signatories or not and whether (as seemed uncertain at the time) the Lisbon Treaty ever became binding, the principles of the Charter of Rights are still likely to be regarded as part of EC law in the guise of underlying "general principles of Community law".

French Courts Strike Down 3 Strikes..

.. which leaves you wondering what next? 4 Strikes? 3 Strikes and a Baby?

Pangloss is in HK with limited Internet so for now merely a quote from excellent Guardian piece on the story:

" Internet users around the world should be cheering the news that French judges have struck down the country's proposed 'three strikes' law for alleged filesharers - and not just because they declared that access to online communications is a human right.

Ever since the French law was first proposed in November 2007, six months after Nicolas Sarkozy took presidential power in France, governments around the world have been building a house of cards surrounding the concept.

Everybody's considered the same law: Britain, New Zealand, Ireland and even America are among the countries that have proposed their own version of three strikes - the idea that anyone thought to have illegally shared files online will get two warnings, before having their broadband connection cut off on the third accusation.

But here's the problem: each proposal has a disturbing tendency to point back to the others in an attempt to shore up its case. I've had conversations with various officials, and read documents from most of the major initiatives, that reference the French law as a precedent, or point out that the British are considering a similar rule."

Legally, if the French courts have truely held that Internet access is a human right, this may be enormously significant, both to EU law as well as to domestic French law and to other areas than sanctions against filesharing. I looks forward to (hopefully?) seeing an English translation of the opinion soon.

EDIT: more comment from Technollama here.