beyondbrics

Foreign technology companies are bracing for the horror scenario that they might lose part or all of their market in China overnight as new rules are expected to take effect Saturday that make government certification compulsory for information security related products but fail to spell out how foreigners can apply.

The so-called 13 standards, a set of certification requirements for 13 different groups of products with an encryption component, had been looming for years, but a storm of protest from foreign enterprises and lobbying by US, EU and Japanese business groups and government officials on their behalf had helped delay implementation until now.

As the rules require makers of encryption-related products such as smartcards to submit their source code to get certification, foreign companies fear this could compromise their intellectual property as well as the security of their products.

But now, foreigners can’t even get that far as submitting their applications. As of Friday night, the relevant government body had published lists with hundreds of Chinese firms who had received certification, but refused to give foreign firms information on how to apply.

“The doors are no longer that wide open, and the red carpet is slowly being rolled up,” said Roland Savoy, managing director of the China unit of Giesecke & Devrient, a German supplier of security-relevant products used in banking, government and telecoms.

“This is hard protectionism applied in a very intelligent way. It is something we have to take seriously,” he said.

Legal experts believe Beijing might wait and see before it clarifies the rules. Wang Xiang, a partner at Orrick, the law firm, in Beijing, said the compulsory certification regime was an attempt to enforce rules on encryption-related products which Beijing announced more than a decade ago.

Related reading:
Crypto protectionism, The Wall Street Journal
China’s encryption rule could shut U.S. businesses out of big market, The Hill