US-China Economic and Security Review Commission, “Red Cloud Rising: Cloud Computing in China,” September 5, 2013

In recent years the Chinese government has prioritized the development of cloud computing technology with the twin goals of expanding Chinese military and civilian access to cloud computing information technology (IT) resources and creating an internationally competitive Chinese  cloud  computing  service  industry.  As  part  of  a  larger  development  strategy  for advancing Chinese software and information technology services, the Chinese government plans to make more than one billion dollars (USD) available over the next few years to drive cloud computing development.

China’s plans in this area have the potential to materially impact US economic and security interests. The emergence of China-based cloud computing services and solutions may raise significant concerns for US consumers, particularly if their data is being stored or processed using infrastructure located within Mainland China. Chinese progress in cloud computing is also important due to the Chinese military’s demonstrated interest in developing and procuring advanced cloud computing technologies.

In order to support the needs of analysts and policy makers, this report characterizes the nature, extent, and future prospects of Chinese cloud computing development from both private-sector and governmental perspectives. In the course of making these assessments, this report describes in detail the complex ecosystem of government bodies, research institutes, private-sector companies,  state-owned  enterprises,  and  military  organizations  that  together  comprise  the Chinese cloud computing industry and the Chinese market for cloud technologies. Particular attention is paid to the security challenges these trends pose for US corporations, consumers, and the US government, as well as how social, legal, and regulatory developments in China may affect foreign users and providers of Chinese cloud services.

The key findings of this report are as follows:
 

Security Issues:
• Any future growth in US consumer use of China-based cloud computing infrastructure would likely raise significant security concerns. Regulations requiring foreign firms to enter into joint cooperative arrangements with Chinese companies in order to offer cloud computing services may jeopardize the foreign firms’ information security arrangements. Furthermore, Chinese- language news sources indicate that China’s primary foreign intelligence collection organization, the Ministry of State Security, has taken an oversight role in projects aimed at bringing foreign cloud computing investment to China.

• Chinese cloud computing infrastructure could be used for offensive cyber operations, but the same is true of public cloud computing platforms globally. If Chinese public cloud infrastructure were ever to become unusually popular for these purposes, it would likely be due to a relative lack of oversight and lax enforcement of rules governing users’ conduct by Chinese service providers, not due to Chinese cloud infrastructure being more ‘weaponized’ than equivalent services in other countries.

• The security vulnerabilities of Chinese cloud infrastructure are not inherently different from those of other cloud infrastructure around the globe. To the extent Chinese cloud infrastructure might on the whole be less secure, it would likely result from increased use of Chinese hardware and software (which, generally speaking, tend to have more security holes than their American counterparts), not from the fundamental design of that infrastructure.

Development of China’s Cloud Computing Industry
• Chinese industry analysis projects that China’s cloud computing industry will continue to grow, with the overall value chain reaching between 750 billion and 1 trillion renminbi (RMB) ($122 to $163 billion USD) by 2015. However, China’s cloud computing industry is beset by shortcomings such as low reliability and energy efficiency in domestic data centers, lack of innovation in core chip development, and inadequate virtualization support, resulting in a lack of domestic demand.

• Although the United States has published and shared technical requirements for its government cloud computing systems, Chinese state guiding documents show no indication that technical requirements for Chinese government cloud computing requirements will ever be shared publicly.

Innovation in China’s Cloud Computing Industry
• China  and  the  United  States  show  differing  attitudes  toward  the  process  of  developing technological standards for cloud computing. While US policies aim to promote homogeneous global cloud computing standards, Chinese policies appear to seek to create additional “indigenous innovation” requirements for domestic sales of cloud computing technology in order to protect Chinese enterprises from foreign competition.

• Some Chinese companies have shown an ability to innovate in this market. Baidu, for example, has designed data centers that claim to be far more energy efficient than others in China. Questions remain, however, as to whether or not Chinese innovation in this sector is driven by intellectual property theft from foreign corporations. Although Chinese company Alibaba Cloud Computing claims that its cloud-based operating system for mobile devices is the first of its kind, Google  argues  that  key portions  of Alibaba’s  operating  system  have  been  copied  from  its Android platform.
 

Access to Chinese Cloud Computing for US Customers and Businesses
• China’s limits and restrictions on foreign investment in value-added telecommunications services mean that US companies must enter into joint ventures with Chinese companies in order to provide cloud computing services to Chinese consumers from data centers in China. Despite challenges to foreign participation in China’s cloud computing market, leading US firms are actively pursuing partnerships and opportunities there. However, questions remain as to whether or not US companies will benefit in the short- and long-term from these limited forms of market participation.

• The Chinese Ministry of Public Security’s sophisticated Internet content-filtering and censorship program, commonly referred to as the “Great Firewall,” continues to exacerbate current barriers to integration between the Chinese and US cloud markets. Recent efforts by investment-seeking provincial Chinese governments to carve out exceptions to the Firewall for foreign corporations appear to have been blocked by the central government.

• It  is  unclear  how  competitive  US  cloud  computing  firms  will  be  in  China’s  government procurement market. The percentage of foreign software and hardware procured for the central government’s e-government services is high but appears to be decreasing. Government policy directs agencies to buy domestic if Chinese products can meet agencies’ demands.

The full report is available here and also at the US-China Economic and Security Commission Review website.