An interview on the accomplishments of the European Chamber Smart Card China Desk

The Information Security China Desk (also known as the Smart Card China Desk), just wrapped up a successful year of supporting industry and advocating on behalf of European manufacturers to the Chinese Government. Donald Chan, chair of the Smart Card China Desk, answers some questions in an interview detailing the group’s accomplishments and challenges they have faced.

Would you mind telling me a little bit about the Smart Card China Desk and its formation at the European Chamber? Why was the decision made to create a desk instead of forming a working group?
The so-called Information Security China Desk, or Smart Card China Desk, was established in 2009 and during the time it was initially established, there existed a complex regulatory environment in China that sometimes suffered from a lack of transparency and was difficult to navigate. So European companies decided, in both the smart card and semiconductor industries, to form this desk. Its purpose, with the help of the European Union Chamber of Commerce in China (European Chamber), was to educate, voice concerns and propose changes in a single voice. The desk also worked hard to submit proposals for changing policy by collaborating on projects like the annual European Chamber position paper. The hope was to provide key recommendations to people in industry and government in order to make a difference.

The formation of the desk allowed us to have conversations, and collaborate, with some major organisations affiliated with the Communist Party of China (CPC). Some of these notable governmental agencies and security standards bodies, included the Ministry of Commerce of the People’s Republic of China, the Office of the State Commercial Cipher Administration (OSCCA) and the Cyberspace Administration of China.

So, you could take your proposals a little more directly to the policy people that have power over the semiconductor and smart card industry?
That is correct, yes. On the one hand, the European Chamber was a great platform where our members had a chance to voice their own individual opinions. It gave us a unique forum for us to gather concerns and proposals from different member companies and interested stakeholders. After gathering information, the desk, with the help of the European Chamber, could then pass along these concerns and have a productive dialogue with various ministries in the Chinese Government.

On the other hand, the desk also received help from the European Chamber to bring this message back to Europe where we could voice our concerns to the European Union (EU) as well.

We joined the yearly tour the European Chamber took to the city of Brussels, which allowed us to explain to the EU exactly what difficulties we were facing in China. We tried to participate in a host of discussions that pertained to EU-China trade, cybersecurity policy, and the smart card industry. At these discussions, we would take the opportunity to educate people on what the companies we represented are facing while operating in China.

Besides acting as a liaison and providing commentary on trade and cybersecurity, what were some of the goals that the desk hoped to accomplish when it was first established?
Since we started in 2009, our desk has conducted many on-site visits and has helped to spread information on the smart card industries that we represent. Despite the plethora of activity during our time at the European Chamber, there were still challenges that we faced and one of particular importance was the obtaining of an OSCCA licence.

Member companies at the desk required this OSCCA licence to participate in certain China-based projects. In early 2014 and 2015, two of our smart card manufacturer members, Gemalto and G&D, managed to successfully acquire this OSCCA licence after using the European Chamber to voice their complaints. In 2017, NXP Semiconductors, one of our members at the desk, was one of the first foreign semiconductor firms to acquire this OSCCA licence.

The requirements imposed by the Chinese Government were restrictive, but by utilising the platform that the European Chamber provided, the desk was able to slowly change this over time.

NXP Semiconductor’s success in acquiring an OSCCA licence shows that the Chinese Government is taking into account the concerns of our members, and is willing to engage with them to better understand the reality on the ground. However, not everything is transparently carried out, which is something we are still working hard on.

Speaking of concerns, what were some of the challenges you faced while working on behalf of the smart card and semiconductor industry?
There are a few major issues that we faced during our time at the European Chamber. OSCCA is a very secretive and powerful state-owned office. Sometimes it was extremely difficult to get them to comment on something, and even if they did, their response was often vague and confusing. Communication is obviously tough when one does not have a steady stream of feedback coming from government agencies. Sometimes we have to be creative to try and seek out answers. For example, we sometimes have academic exchanges with people coming from universities, testing labs and local Chinese smart card industries. We are able to show these agencies what we are doing and after seeing the reality of the situation they can give us a better idea of if what we are asking is feasible.

What do you see in the near future for the smart card and semi-conductor industry? What do you think the effects will be on this industry area, especially with the advent of new cybersecurity regulations and the increased utilisation of big data?
Previously, we were mostly exposed to Chinese encryption regulations in a narrow sense (primarily concerning smart card applications). With new regulations coming ‘down the pipeline’, like the 2017 Cybersecurity Law of the People’s Republic of China, by only advocating on behalf of the smart card and semiconductor industry we will have difficulty ‘pushing our message through’. This is why we are looking to join the European Chamber’s Cybersecurity Working Group.

By joining this working group, the semiconductor and smart card industry will be able to join forces with other tech industries to hopefully influence any future policy. It is hard to predict what will happen to the semiconductor industry, in the future. What we can hope for, is the opportunity for us to bring our existing expertise to new endeavours at the European Chamber.

More information can be found in the European Chamber’s national position paper at: http://www.europeanchamber.com.cn/en/publications-archive/541/Information_Security_Sub_working_Group_Position_Paper_2017_2018