China's anti-terror law, requiring tech companies hand over encryption keys and other sensitive data, is back in parliament and likely to pass soon
Shannon Tiezzi / The Diplomat :
Context & Ripple Effects
This closes out a legislative arc that began in February, when China's first draft of the counterterror law drew objections from the Obama administration by demanding not just encryption keys but installed backdoors. The bill returned to parliament this week with passage expected imminently, and subsequent reporting indicates the enacted text drops the explicit backdoor mandate while keeping the core demand that firms hand over keys and help decrypt information.
First-order effects
- Technology companies operating in China become legally obligated to surrender encryption keys and sensitive data on government request, turning compliance into a condition of market access.
- The Obama administration's stated objections to the February draft are now tested against an enacted statute rather than a proposal, forcing a choice between protest rhetoric and concrete trade consequences.
Second-order effects
- Reuters' reporting that the final law omits the initially planned backdoor requirement signals Beijing calibrated wording under foreign pressure while preserving substance — a template other regulators can copy to blunt criticism without conceding control.
- Encryption-dependent vendors must weigh whether serving Chinese users under compelled decryption undermines their security posture in markets where customers buy products on the promise that no such handover exists.
Third-order effects
- If the pattern holds, lawful-access mandates stop being exceptional demands and become standard licensing terms for national markets, fragmenting global encryption practice along jurisdictional lines.
- The gap between the draft's backdoor language and the softer enacted text points to a recurring dynamic: formal concessions absorb diplomatic pressure while operational access obligations expand quietly.
The trend: Governments are moving from requesting cooperation with encrypted services to legislating compulsory key disclosure, making state access to communications infrastructure a baseline term of doing business.