The “Cryptography Law” has been come into force on 1 Jan. 2020

Cryptography is the core technology and fundamental support for the protection of cyber and information security. It also has a significant influence on a country’s security on politics, economic, national defense and information. However, in China, the legislation concerning cryptography is poor. In 1999, the State Council issued the “Regulations for the Administration of Commercial Cryptography”, and in nearly 20 years, a few supporting regulations were issued. The administration on manufacturing, selling products; providing service; using and importing products with cryptography, and etc., could not meet the needs in practice.

Under such circumstance, at the end of 2019, the Standing Committee of the Thirteenth National People’s Congress passed the “Cryptography Law”, which applies the administrative supervision on key sessions from the perspective of different cryptography categories for the majority issues, except those issues related to national security and social public interests. Some key content of the “Cryptography Law” are listed hereinbelow.

1.The cryptography is administered by category

Cryptography is classified into three categories, namely core cryptography, ordinary cryptography, and commercial cryptography. The core cryptography and ordinary cryptography are state secrets, which shall be used to transmit, store and process state secrets. Commercial cryptography is used to protect information that is not a state secret.

2.The management on commercial cryptography

(1) Non-discrimination principle to foreign-funded companies

Article 21 of the “Cryptography Law” prescribes that the relevant administrative authorities shall equally treat foreign-funded enterprises and other agencies engaging in scientific research, production, sales, services, import and export of commercial cryptography, and administrative agencies and their staff shall not force the transfer of commercial cryptography technologies by administrative means.

(2) To establish and improve the system of commercial cryptography standards

Article 22 of the “Cryptography Law” prescribes that the standardization administrative authority of the State Council and the state cryptography administration shall organize the formulation of national and industry standards for commercial cryptography according to their respective duties. In considering the articles of the “Foreign Investment Law” on encouraging foreign-funded companies to participate in the formulation of standards, the foreign-funded companies which have the business on the scientific research, manufacture and other usage of commercial cryptography would have the opportunities to participate in the formulation of national and industry standards for commercial cryptography.

In addition, the relevant foreign-funded companies might have the advantage of formulating international standards for commercial cryptography, and promotes the transformation between Chinese standards and foreign standards on commercial cryptography, in accordance with Article 23 of the “Cryptography Law”.

(3) The compulsory testing and certification system shall be applied to partial of the commercial cryptography products

The compulsory testing and certification system shall be applied to the commercial cryptography products involving state security, national economy and people’s livelihood, and social public interests; and the commercial cryptography services using critical network equipment and dedicated cyber security products. The products and services hereinabove shall be listed into the catalogue of critical network equipment and dedicated cyber security products.

(4) The issues related to the import and export of cryptography products/services

The import licensing shall be implemented on commercial cryptography that involves State security and public interest and that have encryption protection functions. The export controls shall be implemented on commercial cryptography that involves State security and public interest or that involves the import licensing and export control systems.

The list of commercial cryptography subject to import licensing and the list of commercial cryptography subject to export controls shall be developed and announced by the commerce department of the State Council in conjunction with the state cryptography administration and the General Administration of Customs. However, this list has not been released yet.

Under such circumstance, according to the “Announcement No. 38 from the State Cryptography Administration, the Ministry of Commerce and the General Administration of Customs on the Transition and Connection of Administration of Import and Export of Commercial Cryptography”, prior to the promulgation and implementation of the import licensing list international obligations of China, the import and export of commercial cryptography products shall be subject to licensing-based administration under the currently announced licensing conditions and procedures for the time being. Such as, those engaged in the import of cryptography products or equipment applying cryptography technologies shall comply with the Announcements No. 18 and No. 27 from the State Cryptography Administration jointly promulgated by the State Cryptography Administration and the General Administration of Customs in import of such products.