Kids in Hong Kong and other highly surveilled states worry infosec careers are just asking for trouble

Asian nations in which governments are keen on citizen surveillance struggle to develop ethical hackers, as prospective workers fear their activities may be misunderstood, according to security specialist Mika Devonshire. Devonshire spent much of 2019 and 2020 in Hong Kong, working as a digital forensics and incident response …

[Allan George Dyer]

National Security Law

From my point of view, the National Security Law is quite clear, even though the administration doesn't seem to realise just how broad it is. Two provisions, taken together, make it risky to do any sort of information security: it allows covert surveillance by the national security department of the police (Article 43(6)), and interfering with the performance of duties of state power is an offence of Subversion (Article 22(3)). Suppose a user in your company is under surveillance, you run your anti-virus scanner and remove spyware from their machine... guess who goes to jail for Subversion? If you sourced the scanner from a foreign company, that might also be Collusion with a foreign power under Article 29.

As this law has worldwide jurisdiction, then researchers in the foreign company developing the scanner might also have committed an offence.

Oh, and as this would involve state secrets (there's no point in using a covert surveillance tool that isn't secret), the trial could be conducted in secret.

Don't worry, I'm sure the trial will be conducted to the highest standard of Chinese justice.

[Anonymous Coward]

Re: National Security Law

I stopped messing about with stuff on the internet back in 1994. Nothing malicious. I was just curious how things worked back then and wanted to see how far the rabbit hole went. I seem to remember a couple of high profile cases where people who tried to see what's what got locked up. That was the end of my foray into the dark (white hat) arts. I still know a thing or two to be fair.

[Anonymous Coward]

@Allan George Dyer - Re: National Security Law

Oh yeah ? Then read this : https://en.wikipedia.org/wiki/Aaron_Swartz (especially the Arrest and prosecution section of the article) and come back and lecture us about it.

In case of TL;DR, here's the interesting bit: [QUOTE] According to state and federal authorities, Swartz used JSTOR, a digital repository, to download a large number of academic journal articles through MIT's computer network over the course of a few weeks in late 2010 and early 2011. At the time, Swartz was a research fellow at Harvard University, which provided him with a JSTOR account. Visitors to MIT's "open campus" were authorized to access JSTOR through its network.[/QUOTE]

If I'm not mistaking, those laws are still valid.

[veti]

Re: @Allan George Dyer - National Security Law

And that is comparable - how, exactly?

[Anonymous Coward]

Re: @Allan George Dyer - National Security Law

They are but to be fair they mean shit. If you know where to look you can find anything.

[Blackjack]

Those kids are not wrong, China is a Big Brother state.

First they tell companies to develop a Social Security Score System and then they tell the exact same companies they have being spying too much.

And is not just companies that dared to criticize the government but any company that's affected by these regulations changes.

So really, you can do everything right and still get hurt because the mighty Big Brother decided to change his mind.

[martinusher]

Not unusual

Its easy to lose sight of the fact that the activities that precipitate the law change would have been illegal in the US and UK. Especially as the involve outside (overseas) funding.

Nation states will take whatever measures they need to protect themselves. How they're appleid will vary from state to state, society to society, but the general rule applies. In the case of the Hong Kong students they were afforded far more leeway than they would have been if they had been on a US campus before the police intervened.

I'm not justifying this, just stating the reality. Its easy to get into a "four legs good, two legs bad" mindset and the national budget to engender this is (in the US at least) quite large, its hundreds of millions of dollars. ("Your tax dollars at work") One way to combat this is to call it when you see it.

[Allan George Dyer]

Re: Not unusual

@martinusher - You can't assume that you know which particular activities precipitated the law change because it was decided by the National People's Congress Standing Committee (NPCSC) and promulgated to Hong Kong without any debate or public consultation. You (unless you happen to be a member of the NPCSC, are you?) and I have no idea why they decided on this course. The trigger might have been violent acts that are also illegal in the UK and US - and illegal under existing HK law, although there seems to be some selectiveness in which cases are investigated and prosecuted (take a look at the 7.21 Yuen Long attack, or the IPCC report). Or the trigger might have been peaceful protests by over 1 million people, activities that are legal in the UK and US, and were legal in HK.

There has been a lot of talk about overseas funding, but the claims have not yet been backed up by evidence in court.

If the HK Police have shown leniency, with the claims of violence and sexual assault, compared to the US Police, then it just shows how much the US Police need to improve and learn lessons from the George Floyd case.

[ecofeco]

Biting the hand...

...that feeds I.T.

...has never been more appropriate. And China may have bit off more than it can chew.