Should Americans Trust China with Their Cloud Data?

October 1, 2023May 12, 2024 Bill

Microsoft Azure and Amazon AWS Cloud Hosting in China.

Cloud computing is a booming industry that offers many benefits for businesses and individuals, such as scalability, cost-efficiency, security, and convenience. However, there are also some challenges and risks involved, especially when it comes to data privacy and sovereignty. This is particularly relevant for Americans who want to store their cloud data with Azure and AWS, two of the leading cloud service providers in the world, but also have subsidiaries in China, a country with strict and controversial data regulations.

How Azure and AWS Operate in China

Azure and AWS are both global cloud platforms that have data centers in multiple regions around the world, including China. However, due to the Chinese government’s requirements, they cannot operate directly in China, but have to partner with local companies that have the necessary licenses and approvals. These local partners are responsible for managing the physical infrastructure, billing, customer service, and compliance with Chinese laws.

For Azure, the local partner is Shanghai Blue Cloud Technology Co., Ltd. (“21Vianet”), a wholly-owned subsidiary of Beijing 21Vianet Broadband Data Center Co., Ltd., which is one of the largest internet service providers in China. Azure customers in China have to sign a contract with 21Vianet, not Microsoft, and use a separate portal (https://www.azure.cn) to access the Azure services. Azure China operates two regions: China North (Beijing) and China East (Shanghai).

For AWS, the local partners are Beijing Sinnet Technology Co., Ltd. (Sinnet) for the AWS China (Beijing) Region, and Ningxia Western Cloud Data Technology Co., Ltd. (NWCD) for the AWS China (Ningxia) Region. AWS customers in China have to sign a contract with Sinnet or NWCD, not Amazon, and use a separate portal (https://www.amazonaws.cn) to access the AWS services. AWS China operates two regions: China (Beijing) and China (Ningxia).

What Are the Risks of Storing Cloud Data in China?

Storing cloud data in China poses some potential risks for Americans, mainly related to data privacy and sovereignty. Some of these risks are:

Data access: The Chinese government has the authority to access any data stored within its territory, regardless of who owns it or where it originates from. This means that the government can request or compel 21Vianet, Sinnet, or NWCD to disclose any customer data stored in Azure or AWS China regions, without notifying or obtaining consent from the customers. The government can also block or censor any data that it deems sensitive or harmful to its interests.

Data transfer: The Chinese government imposes strict controls on cross-border data flows, requiring any entity that collects or processes personal information or important data of Chinese citizens or organizations to store it within China and obtain approval before transferring it overseas. This means that customers who store their data in Azure or AWS China regions may face difficulties or restrictions when they want to move their data out of China or access it from other regions.

Data protection: The Chinese government has enacted various laws and regulations to protect data security and privacy, such as the Cybersecurity Law, the Data Security Law, and the Personal Information Protection Law. However, these laws and regulations may not be consistent with or equivalent to the standards and practices of other countries, especially those that have more stringent or comprehensive data protection frameworks, such as the European Union’s General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA). This means that customers who store their data in Azure or AWS China regions may not enjoy the same level of data protection as they do in other regions.

How to Mitigate the Risks of Storing Cloud Data in China?

Storing cloud data in China is not necessarily a bad idea, as long as customers are aware of the risks and take appropriate measures to mitigate them. Some of these measures are:

Data classification: Customers should classify their data according to its sensitivity and value, and decide which data can be stored in China and which data should be stored elsewhere. For example, customers may choose to store their non-sensitive or public data in China for performance or cost reasons, but store their sensitive or confidential data in other regions for privacy or security reasons.

Data encryption: Customers should encrypt their data at rest and in transit, using strong encryption algorithms and keys that they control. This can help prevent unauthorized access or disclosure of their data by third parties, including the Chinese government or its local partners. Customers should also avoid using encryption services provided by 21Vianet, Sinnet, or NWCD, as they may not be trustworthy or reliable.

Data backup: Customers should backup their data regularly and store it in multiple locations, preferably outside of China. This can help ensure the availability and integrity of their data in case of any disruption or loss caused by natural disasters, human errors, cyberattacks, or government actions.

Conclusion

Storing cloud data in China with Azure and AWS is a complex and risky decision that requires careful consideration and planning. Customers should weigh the pros and cons of using Azure or AWS China regions, and take steps to protect their data privacy and sovereignty. Customers should also consult with legal and technical experts to ensure compliance with the relevant laws and regulations of both China and their own countries.