Trafficking in Assertions on Data in China Lacks Explanatory Power

T he issue of China and data, including Chinese government access to data, has become one of the most discussed topics in U.S.-China relations. News on this issue seems to emerge on a daily basis—whether it is the Montana governor banning TikTok, claims that Chinese drones are sending data back to Beijing, or headlines claiming that China is blocking outbound data flows due to national security concerns. In her new book Trafficking Data: How China Is Winning the Battle for Digital Sovereignty, Aynne Kokas offers a sweeping view of the data landscape and its nexus with China, from TikTok to WeChat to the Digital Silk Road. There is much to say about the evolution of China’s data governance, which has progressed substantially since its Cybersecurity Law was enacted in 2016 and implemented in 2017, as well as about successful Chinese apps such as TikTok and WeChat. While well-researched in places, the book, like many articles on China and data, makes initial assumptions, and then builds theories of risks on top of a largely unexamined set of theses about the Chinese government, its ability and intention regarding data handling, and how it interacts with private-sector companies that dominate the data space in China. Kokas seems to accept, somewhat uncritically, that the Chinese government demands and can access all data collected and processed by Chinese technology platforms. The book also argues that the Chinese government seeks to put together bits of information from different Chinese and Western sources under the concept of “mosaic theory,” which holds that such data points, when taken together, present risks to individuals or companies (see p. 147). Both of these approaches assume that China has grand designs to control all data and leverage it for nefarious ends. But on closer examination, the validity of building further constructs upon these assumptions looks quite dubious. The standard assessment of China’s national security and intelligence laws (including the Cybersecurity Law) as mandating companies to turn over data to the government is inaccurate on several levels (see p. 120).