China Internet Security Law and WTO!?

There is a new Law effective in China being 1 March 2006.
A brief outline is here http://news.xinhuanet.com/it/2005-12/29/content_3986087.htm
The full legislation is here 互联网安全保护技术措施规定 .

There are some interesting observations from an IT security perspective:

1. This regulation is under the regime of China Police Force.

2. Article 7.1.2 requires ISPs to have disaster recovery ability for vital database and system equipments.

3. Most of the regulation requires ISP or who operate internet services (loosely defined at Article 18) to record and store users login time, IP address, user account information and system logs.

4. ISP has to maintain records if they find any illegal materials being distributed to the public. (“What means by illegal in the China?” is a mystery).

5. China Police could punish entity if they fail to perform Article 7 to 14. But there is no indication of what kinds of punishment should be.

First, as a security professional, I appreciate China government is working on legal protection of their Internet Infrastructures. But it seems stress on monitoring measures more than preventive measures. And the amount/details of information to be recorded by ISP have little to do with Internet security. The fact that it is under the regime of Police force made me think that it is more a surveillance measure for China government.

If this regulation is enforced strictly, China ISP will be the biggest buyer of storage devices. Imagine the sheer amount of data generated every second. But this regulation does not specify how long the data should be kept!

Just by reading this regulation, I believe even China open telecommunication industry to foreign companies, no sensible company will enter the ISP market!