In early July, after China’s largest online ride-hailing platform Didi was listed in the US, the Cyberspace Administration of China (CAC) initiated a national security investigation into Didi. One major move was the removal of the Didi app from app stores. And on 9 July, the CAC announced that 25 Didi-related apps would also be removed.
Such harsh administrative penalties got many people in the sector speculating whether Didi really offered top secret urban mapping data to the US. It is not the intention of this essay to go into conspiracy theories and rumours. Whether or not Didi really provided the US with essential information about China in exchange for quickly getting listed, the fact is, governments of nation states with competitive internet industries would now be ramping up regulations on overseas listings of their local internet platforms.
In today’s internet era, one key characteristic of data security is that it is almost impossible to arrive at an accurate assessment of the national security risks posed by data on an online platform through simple data analysis, because the risks associated with data are amplified when various types of data are combined.
For example, a food delivery platform provides data on meal orders from an industrial area. On its own, all it reflects is the meal preferences in that area — what workers eat and their living standards. But put it together with insurance data, and you would be able to get quite a good picture of the extent of non-regular employment in the area. Add in data on residential rentals, and you can even dig up where illegal workers congregate.
For the US with its oceans of data, the risks of associated data leaks of other countries are becoming mathematically beyond control.
A choice between development and security?
So, analysing the data on a platform together with other third party data leads to confidential information leaks. Let us call this associated data leakage. Assessing associated data leakage calls for analysis of other third party data together. Performing a risk assessment of data leakage on just one platform is not going to lead to a reliable result. Worse, the platform companies of many countries with huge internet data, such as China, are usually aiming to get listed on the US market; while the US has the greatest volume and variety of internet data in the world, as well as the largest amount of emerging data, making it the number one power in terms of internet technology and data.
With the proliferation of mobile internet and the growth of 5G and the Internet of Things (IoT), the data that various platforms can provide is growing exponentially. For the US with its oceans of data, the risks of associated data leaks of other countries are becoming mathematically beyond control. This posed a dilemma to all the other countries besides the US that want to achieve results in the internet sector: development and growth, or security?
Achieving both the right of legislation and right of taxation
To a large degree, a country’s level of internet development is equivalent to the level of its internet platforms. These platforms are internet companies with the “right of legislation” and “right of taxation”.
Right of legislation means “laying the law” within the scope of its internet services — setting operating rules, welcoming those who keep to the law, and evicting those who do not. Facebook, WeChat, and ByteDance can set the rules for regular users, we-media operators, and gaming companies that depend on them to operate, while Taobao and Amazon set rules both as the buyer and seller.
... traditional governments uphold their powers through enforcement agencies, while internet platforms are purely commercial organisations and clearly do not have this capability. Their authority comes from their scale.
Right of taxation means the authority to collect economic resources from its platform partners, mainly the content providers or brand advertisers. On the other hand, collecting fees from end users is not considered taxation, because for example, traditional Microsoft software services are not internet platform operations.
Rights of legislation and taxation sound like traditional government powers; the difference is that traditional governments uphold their powers through enforcement agencies, while internet platforms are purely commercial organisations and clearly do not have this capability. Their authority comes from their scale.
Only when they are big enough and nearly monopolise the entire industry will their rights of legislation and taxation be effective, because the biggest threat they can level at their partners is eviction from the platform. If a platform is not big enough, partners can do business with them or with others, and when that happens, the platform’s rights of taxation and legislation are not guaranteed.
...one foreseeable short-term result is that countries can only increasingly rely on domestic, politically-backed capital for the growth of internet platform companies.
This means that before an internet platform emerges as the ultimate winner and completes its monopoly, it is practically impossible to earn profits through the right of taxation. So, over the past 20 years, internet platforms have been the largest investment target and beneficiary of US capital. Only with the support of US capital have they been able to have enough funds to rapidly grow and beat their competitors and gain the monopoly, even while losing enormous amounts of money. And only the US capital market (Nasdaq) would tolerantly allow these loss-making giants to get listed for cash, just to make sure that the investors who burned their cash during the platform’s development period get their investments back as soon as possible. For example, China’s stock market requires companies to have at least three years of profits before getting listed, which practically rules out all internet platforms from China’s stock market.
If internet platform companies can get blocked from getting listed in the US due to data security issues, and they are practically inseparable from the strong backup of the capital market, then one foreseeable short-term result is that countries can only increasingly rely on domestic, politically-backed capital for the growth of internet platform companies. This might be an unexpected boon for countries with strong sovereign funds, such as Singapore.
Related: Ride-hailing giant Didi slapped with Chinese cybersecurity review days after IPO | Blindspots in the financial regulation of China’s tech ‘platform companies’ | What the Chinese government wants to tell Alibaba and China's tech giants [Part II] | Why is Beijing punishing Didi?
