At the US / Russia summit in June, two key issues raised by President Biden were election interference and ransomware aggression. Recent ransomware episodes, like the attacks on Colonial Pipeline and the mass-ransom of 1,500 Kaseya clients, are simply part of the ecosystem in Vladimir Putin’s kleptocracy.

For years, Russia and North Korea have launched hack-and-leak operations, offensive cyberattacks, and blurred the line between hacker gangs and intelligence agencies. Meanwhile, China tended to focus on traditional espionage and intellectual property theft. But times have changed. China is now the primary adversary in an escalating cold war with western democracies, and data security is the front line of that battlefield.

Accusations of state-sponsored hacking by Chinese agents and proxies are increasing. In July the US joined the UK, EU, and other governments in condemning a string of Chinese hacking operations. The DOJ separately indicted four Chinese hackers, three of whom are believed to be officers of China’s Ministry of State Security (MSS). The White House specifically blamed the MSS for a hacking campaign that used Microsoft’s Exchange Server to compromise thousands of organizations.

China recently stunned the world by launching an investigation into “data violations” at Didi Global Inc. and blocking downloads of its app just days after the company raised $4.4 billion in a US stock offering. Didi is the largest ride-hailing company in China, with 493 million users and a 90% market share.

Analysts speculated that the Chinese Communist Party (CCP) was alarmed after a social media post used Didi’s ride data to track the volume of workers commuting to government ministries in Beijing. Immediately on the heels of this news, China’s State Council also warned that it would crack down on overseas listings by Chinese companies in the interest of “safeguarding national security.”

These moves are just the latest in a series of efforts by the CCP to curb the power of Chinese tech firms. Many believe the clampdown on foreign listings was spurred by changes in the reporting requirements for foreign firms listed on American stock exchanges. In March, the SEC implemented new rules that require foreign companies to allow audits by the Public Accounting Oversight Board – already a requirement for domestic companies. Firms also must prove they are not owned or controlled by a foreign government, and name any board members who are CCP officials.

Several salvos in this conflict were launched during the Trump administration. The US accused Huawei, the largest global manufacturer of networking equipment, of willfully violating trade sanctions the US had levied against Iran. In response, American companies were banned from doing business with Huawei. The US also lobbied its allies to exclude Huawei and ZTE from 5G networks and other critical infrastructure as a result of alleged ties with the Peoples Liberation Army, clandestine state ownership, and their role in facilitating the mass surveillance and detention of Uyghur people in Xinjiang.

Huawei and ZTE claim their equipment is no more surveillance-prone than gear made by others. Even if this characterization is accurate, it ignores laws that require companies operating in China to store their user data inside China, and to share it with state agencies upon request.

Those laws effectively turn every internet company in China into a surveillance organ of the CCP. This issue was seen as one of the primary reasons why Google exited the Chinese search engine market in 2010, though the company emphasized censorship concerns.

Chinese diplomats argue their laws are mechanically equivalent to the telecom monitoring enabled by the USA Patriot Act. They also claim their surveillance of ethnic minorities in Tibet and Xinjiang is equivalent to the domestic NSA monitoring programs that Edward Snowden exposed in 2013.

Huawei consistently denies accusations of state ownership and military collaboration. It claims to be employee-owned, but that characterization has been vigorously disputed. Prior to 2019 it did not even refer to itself as a private company. A trade union committee holds 99% of Huawei’s holding company shares. Outside analysts have concluded that employees do not have any property rights to those shares, and that Huawei is effectively state-owned.

Data security was also the driver behind former President Trump’s effort to restrict TikTok and WeChat. In 2020 Trump issued executive orders that banned the apps from operating in the US unless they were sold to a domestic company. Those orders were blocked by US courts and ultimately rescinded. However, President Biden kept the issue alive by replacing Trump’s executive order with a new one that calls for a broad review of foreign-controlled apps that could pose a security risk to Americans and their data.

Many digital natives express ambivalence about privacy. Nonetheless, “big data” is perceived as a strategic threat by sovereign governments. A global race is underway to yoke the user data of internet companies to state intelligence purposes while blocking access to that data by adversaries. That data cold war will shape the economics and architecture of the digital world for generations.