ANNUAL REPORT

56
U.S. Tech Firms and Their Chinese Partners—Continued
to allow the Chinese government to review some of its product
source code in a controlled environment.*
China is also intensifying its advocacy of “cyber sovereignty” as a
global regulatory norm. In his keynote address at the second annual
World Internet Conference in December 2015, President Xi argued
for “the right of individual countries to independently choose their
own path of cyber development, model of cyber regulation and Internet
public policies, and participate in international cyberspace governance
on an equal footing” and defended Beijing’s Internet censorship.
151 Chinese authorities have shifted away from not publicly
admitting China’s censorship efforts to using the concept of “cyber
sovereignty” to argue for increased government control of the Internet.
According to Samm Sacks, a China technology policy analyst at
the Eurasia Group, the Chinese government’s intense advocacy of
sovereignty in cyberspace “could eventually over the long term lead
to fragmentation of the U.S.-led global Internet.” 152
Update on China’s Commercial Cyber Espionage
In addition to enacting ICT and cybersecurity policies aimed at extracting
technologies from U.S. companies, China has conducted cyber
theft operations to gain access to U.S. intellectual property and technology.
Pervasive Chinese cyber espionage against U.S. commercial entities—detailed
in the Commission’s 2015 Annual Report to Congress †—
continues to pose a grave threat to U.S. economic security despite
China’s agreement in 2015 not to support commercial cyber espionage
conducted by Chinese actors. In a September 2015 memorandum of understanding
(MOU), the United States and China pledged that “neither
country’s government will conduct or knowingly support cyber-enabled
theft of intellectual property, including trade secrets or other confidential
business information, with the intent of providing competitive
advantages to companies or commercial sectors.” 153 (For a discussion
of China’s non-commercial cyber espionage activities, see Chapter 2,
Section 3, “China’s Intelligence Services and Espionage Threats to the
United States.”)
Public reports suggest Chinese cyber espionage against U.S. companies
persists, but has declined in frequency since September 2015. 154 It
is unclear whether this trend is attributable to the MOU. 155 FireEye,
a cybersecurity firm, reported in June 2016 that a precipitous drop in
detected incidents of Chinese cyber espionage against U.S. companies
began more than one year before the MOU came into effect. 156 Notably,
the beginning of this decline roughly coincided with the U.S. Depart-
* IBM said in a statement it “has in several countries established the capability to conduct limited
demonstrations of specific aspects of [its] technology in highly-controlled IBM environments
that have no external communication links.” According to the company, its intent in sharing some
product source code was “to reassure key stakeholders, including our clients, that no means exist
for other parties to access IBM technology or data we manage on behalf of clients.” IBM further
maintained it “does not provide government access to client data or ‘back doors’ into [its] technology.”
IBM, “IBM Statement on Limited Technology Demonstrations,” October 16, 2015.
† U.S.-China Economic and Security Review Commission, Chapter 1, Section 4, “Commercial
Cyber Espionage and Barriers to Digital Trade in China,” in 2015 Annual Report to Congress,
November 2015, 192–225.