- China implemented new regulations on Monday under its toughened counterespionage law, which enables authorities to inspect smartphones, personal computers and other electronic devices, raising fears among expatriates and foreign businesspeople about possible arbitrary enforcement.
- A Japanese travel agency official said the new regulations could further prevent tourists from coming to China. Some Japanese companies have told their employees not to bring smartphones from Japan when they make business trips to the neighboring country, according to officials from the companies.
The new rules, which came into effect one year after the revised anti-espionage law expanded the definition of espionage activities, empower Chinese national security authorities to inspect data, including emails, pictures, and videos stored on electronic devices.
Such inspections can be conducted without warrants in emergencies. If officers are unable to examine electronic devices on-site, they are authorized to have those items brought to designated places, according to the regulations.
It remains unclear what qualifies as emergencies under the new rules. Foreign individuals and businesses are now expected to face increased surveillance by Chinese authorities as a result of these regulations.
A 33-year-old British teacher told Kyodo News at a Beijing airport Monday that she refrains from using smartphones for communications. A Japanese man in his 40s who visited the Chinese capital for a business trip said he will "try to avoid attracting attention" from security authorities in the country.
In June, China's State Security Ministry said the new regulations will target "individuals and organizations related to spy groups," and ordinary passengers will not have their smartphones inspected at airports. However, a diplomatic source in Beijing noted that authorities' explanations have not sufficiently clarified what qualifies as spying activities.
Last week, Taiwan's Mainland Affairs Council upgraded its travel warning for mainland China, advising against unnecessary trips due to Beijing's recent tightening of regulations aimed at safeguarding national security.
In May, China implemented a revised law on safeguarding state secrets, which includes measures to enhance the management of secrets at military facilities.
This is the approach I use with laptops domestically, and I think that there's something to be said for it. Like, the laptop itself doesn't store important information. A remote server does. The laptop is just a thin client. If the laptop gets lost or stolen -- which I've had happen -- I revoke the credentials. No important information is lost, and no important information is exposed.
Whole-disk laptop encryption has improved things too from an exposure standpoint (albeit not a loss standpoint), though I don't use it myself (don't want to spend any battery life on it). I assume that smartphones have some form of reasonably-secure storage hardware, but I don't know if it involves encryption.
What I found irritating -- and this is years back now -- was an employer who didn't care if I took a laptop in or out or what information I stored on it (as long as it was a work system), but who refused to provide remote access to the network, so I couldn't just keep the important information on the work network. I mean, I get if they want to have some sort of isolated DMZ and require an externally-accessible server to live there, not provide VPN access in to the general network, but not having the ability to have remote network access to work systems at all is just incredibly obnoxious.
I think that some of it is that Windows is not phenomenal to use remotely. Yeah, there are solutions, but they aren't great if you're on a high-latency, low-reliability, or low-bandwidth link. I try to use console Linux for as much of my stuff as possible. That whole ecosystem was designed around thin-client, remote use.
Oh yeah. I DEFINITELY have some horror stories over needing to access GUI apps remotely (my favorite involved a secure tunnel to one facility to then tunnel back to a machine that was literally three doors down from my office...)
But stuff like the web interfaces to ms/google office make the vast majority of this trivial. Since SSH always worked in Windows via (god awful) putty. And increasingly other applications are understanding they need to support server/client setups so you are just connecting over a tunnel rather than using a remote desktop protocol.
I mean, Windows can do the thin client side fine. I'd personally somewhat-prefer to use Linux for that, but that's not really my sticking point. I'm normally keeping my software, data, stuff like that on the server, and just running two remotely-connected terminals and a web browser on my client. Virtually all the software can run on the server. My problem is Windows on the server side; like, it's just not reasonable to use a Windows machine remotely via a command-line for anything other than some very basic administrative tasks, and using a GUI remotely once latency goes up or bandwidth down is just painful.