Corporate compliance programs must address the risk of improper disclosures of sensitive technical or commercial information.
State control of information has been a focus of PRC regulation since the founding of the Peoples Republic m 1949. Despite several updates to laws governing "state secrets" m China over the years, the concept of state secrets remains amorphous and subject to interpretation in line with prevailing political winds. Foreign companies in China must be aware of the serious implications state secrets laws pose on inbound and outbound trade and investment, especially given the PRC governments increasing emphasis on foreign compliance. Firms doing business m China must implement comprehensive compliance policies and training programs to prevent employees from violating China's state secrets laws.
The evolution of China's state secrets laws
The PRC government issued its first regulations governing state secrets in 1950 and 1951. The regulations were broad and reflected Chairman Mao Zedong and Premier Zhou Enlai's objectives at the time: political consolidation after decades of revolution as the government sought to combat perceived "enemies within and without" the country. Accordingly, the 1951 regulations listed a wide range of topics that could be considered state secrets - from highly sensitive matters, such as national defense, foreign relations, state finances, and infrastructure, to much less sensitive matters, such as culture, education, hygiene, and meteorological forecasts. What could not be captured through broad and vague classifications was included m a catch-all provision covering "all state affairs not yet decided upon" and "all other state affairs that must be kept secret."
1988 State Secrets Law
Chinas more recent state secrets regime is based on the 1988 Law on Guarding State Secrets, which attempted to balance former leader Deng X�aop�ng's push to open up to the outside world with the states interest m controlling certain types of information. The law is clearer and more detailed than the 1950 and 1951 regulations. Upgrades included categories for secrets based on sensitivity (top secret, highly secret, and secret); procedures for declassifying of information because of changes m circumstance or time; and clearer government agency responsibilities for classifying and handling information. The law, however, still lacks clarity in important areas that affect how Ch�nese and foreigners acquire, handle, store, and convey information. Most notably, the laws definition of "state secrets" remains ambiguous. It provides a narrower list of �tems that could potentially be considered state secrets, yet still contains a catch-all provision for "other matters that are classified as state secrets by the national State Secrets Bureau," with no limitation on what those matters might be. In effect, the vague "state secrets" label allows the government to choose which potential violations to prosecute and which to ignore. For foreign companies m China, however, it creates difficulties in managing risk: How does one ensure compliance with a law when what constitutes a violation remains unclear?
2010 amendments
The PRC government recently released Amendments to the State Secrets Law, which took effect in October 2010. The amendments add clearer standards for identifying and handling classified information, delineate authority to determine what should and should not be classified, and take into account technological developments such as the Internet.
The new amendments prohibit connecting computers that contain classified information to the Internet and other public information networks. They also stipulate that pr�vate communications may not "touch upon" state secrets and require Internet service providers and other public network operators to cooperate with state secrets investigations. Though the 20 1 0 amendments provide clearer guidance for businesses on how to adhere to the law, they also make explicit that Ch�nese network operators and service providers must cooperate with a state secrets regime often used to suppress political dissent.
The 2010 amendments introduced a welcome system for labeling classified information. In addition to maximum protection periods for various categories of classified information, the amendments state that even at lower levels of the bureaucratic chain, the State Secrets Bureau must wherever possible identify the specific people who are permitted access to the information. Moreover, the amendments provide that all devices and objects that carry classified material must be clearly marked as such. The amendments do not, however, clarify the state secrets classifications themselves or the broad range of information that can be covered by the State Secrets Law.
Criminal and state security laws
The State Secrets Laws ambiguity is of concern given the criminal implications of state secrets violations under Chinas Criminal Law and Security Law. Article 1 1 1 of the Criminal Law provides for penalties ranging from public surveillance and deprivation of political rights to life imprisonment, depending on the severity of the act, for "whoever steals, spies into, buys, or unlawfully supplies state secrets or intelligence for an organ, organization or individual" outside Chinas territory. For an especially severe act that endangers national security, the article states that individuals may receive the death penalty. Article 282 provides for up to three years imprisonment for a person who "unlawfully holds documents, material, or other objects classified as 'strictly confidential' or 'confidential' state secrets and refuses to explain their sources and purposes." The Security Law addresses similar violations m the state security context.
Commercial secrets, corruption, and bribery provisions
PRC law also protects "commercial secrets." The 1993 Anti-Unfair Competition Law protects commercial secrets of state-owned enterprises (SOEs), and the 2010 Provisional Regulations for the Protection of Commercial Secrets by Centrally Governed Enterprises clarify the treatment of commercial secrets for top-level SOEs. Though the provisional regulations introduce stricter requirements for classification decisions and the labeling of classified information, they do little to clarify the Anti-Unfair Competition Law's ambiguous definition of "commercial secrets." (Parties that enter into business dealings with SOEs should note that the provisions require SOEs to adopt precautionary measures to protect commercial secrets in dealing with third parties.)
Related to state secrets legislation, Chinas Criminal Law and Anti-Unfair Competition Law are the basis for the state s corruption and bribery legal regime. According to these laws, commercial bribery offenses involve securing an "improper benefit" through "improper means." PRC authorities are likely to view a company that holds classified commercial information as having acquired an improper benefit, and the provision of such a secret by a company can easily be construed as improper means. Thus, corruption and bribery allegations often go hand m hand with alleged state or commercial secret disclosures.
Application of state secrets and related laws
The 2008 R�o Tinto case, m which four employees of the Australian mining conglomerate R�o Tinto Group were accused of commercial espionage by Ch�nese authorities, illustrates how state and commercial secrets, corruption, and bribery can converge in real-life dealings and result in criminal responsibility. The Shanghai Intermed�ate Peoples Court determined that R�o Tinto executive Stern Hu and his colleagues "enticed" the disclosure of information regarding a ser�es of conferences convened by the Ch�nese Iron and Steel Association. Attended by representatives of key Ch�nese manufacturers, these conferences focused on the industry's strategy for upcoming iron ore price negotiations with R�o Tinto. The court inferred that Rio Tinto employees "improperly obtained" conference information, even though sources volunteered the information without solicitation from R�o Tinto employees. This case suggests that the Ch�nese courts may infer impropriety m situations where Ch�nese companies volunteer commercially sensitive information to foreign companies, even when no agreement has been made for favors in return. Foreign companies must thus be aware that they could violate commercial secrets or bribery laws by passively accepting information m circumstances where they are in a position to bestow favors or exert influence.
In addition to facing direct compliance risks, foreign technology companies face the added challenge of handling PRC information requests related to state secrets investigations of others. The requirement m the 2010 State Secrets Law amendments that network operators and service providers in China cooperate with such investigations underscores what has been the reality for some time - that technology firms are under tremendous pressure to share information with Ch�nese authorities. To date, companies have tended to take one of two contrasting approaches to this struggle - conflict with PRC authorities and withdrawal from the China market, or cooperation with the government resulting in client alienation and potential human rights litigation. Both approaches present significant challenges to business expansion.
Practical implications for US business in China
In the past, foreign businesses in China focused primarily on complying with their home countries' laws, such as the US Foreign Corrupt Practices Act, and regarded PRC state secrets laws as a concern for local firms. Foreign companies can no longer afford to take this approach, especially given the recent increase in cases that apply PRC state secrets law to foreign firms. The risk of state secret disclosure is particularly high in the approval process for equity investment and debt financing of foreign-invested projects m China. These projects necessitate the flow of highly detailed commercial and technical information as part of the planning and application process, and present numerous state secret-related risks for firms that pursue them.
Foreign businesses operating in China can take steps to better protect their interests and employees. In particular, companies should:
* Develop robust compliance policies Policies should include a mandate for employees to avoid exposure to classified or potentially classified information without proper permission from appropriate PRC authorities. The mandate should make clear that any information that could result in an unfair competitive advantage in a commercial transaction should be avoided without appropriate authorization. The policies should also include a zero-tolerance policy for corruption and bribery in every aspect of commercial activity in China, including strict limits on gift-giving and the extension of other perks.
* Ensure through regular training sessions that all staff are well-versed in PRC state secrets laws and in the firm's compliance policy The training should provide details of classification standards and labeling requirements under PRC law, as well as guidance on what types of unlabeled information could still be considered sensitive. Potentially sensitive unlabeled information includes raw market or industry data that is not publicly available, and processed or analyzed data whose underlying raw data is publicly available. Training is especially important for Ch�nese or Chinese-speaking employees who are most likely to be on the "front lines" in negotiations and other dealings with local partners and are most vulnerable to inadvertent exposure.
* Obtain explicit assurances from Chinese counterparties prior to information exchanges The assurances should confirm that no information provided will constitute state or commercial secrets or, to the extent it does, that the Ch�nese counterparty has obtained appropriate authorization to share the information with the firm's representatives. These assurances are particularly important in connection with foreign direct investment approval processes and due diligence exercises.
* Be aware of the precautionary measures SOEs are required to take to protect commercial secrets Such measures include entering into confidentiality agreements for all information exchanges and clearly labeling classified information. Companies should also ensure that any SOE the firm is working with complies with these procedures. If an SOE does not appear compliant, the foreign company should raise the issue and express its desire to fully comply with all PRC laws.
Practical implications for US and Chinese businesses in the United States
Chinas state secrets laws can also burden Ch�nese enterprises that seek to expand internationally. Efforts made by Ch�nese enterprises operating in the United States to comply with PRC state secrets laws can create difficulties m complying with US regulations and disclosure requirements. Given that US regulations and case law allow few exceptions for foreign enterprises based on home country legal commitments, some Ch�nese businesses may be forced to limit their US expansion plans.
Foreign banks that wish to expand m the United States, for example, must make available to the Board of Governors of the Federal Reserve System all information on bank operations that the Federal Reserve deems necessary to enforce compliance with applicable US laws. PRC banks that refuse to comply with this requirement run the risk of losing their licenses to operate m the United States. If, for example, US regulators request information about a PRC bank or one of its customers that could be considered a state or commercial secret (a likely scenario given the United States' expansive antimoney laundering and an t� terrorism laws), the PRC bank may find itself in an impossible situation.
Conflicts between US law and PRC state secrets laws also arise through US courts' civil litigation discovery processes. US courts generally decide such conflicts by weighing factors such as national interests, hardship of compliance, importance of the laws at hand, and good faith of the parties. But even �f a US court compels compliance, PRC authorities may not absolve the Ch�nese company from home country obligations.
China's state secrets regime and the conflicts it creates with US law may increasingly concern Ch�nese executives at the front of China's outbound direct investment drive. Future Ch�nese executives that lead outward investment expansion programs could find themselves on the wrong side of these laws in the bidding, negotiation, or transaction execution phases of a project.
The way forward
The control of sensitive information has been a focus of China's legislation and regulation since the founding of the People's Republic. Government reforms have refined some aspects of state secrets law over time, but other aspects of the laws remain ambiguous in scope and intended application. As such, Ch�nese and foreign businesses must be vigilant when dealing with sensitive information and implement effective and pragmatic policies, procedures, and internal controls to manage the regulatory risk presented by the flow of information m today's cross-border business environment.
[Sidebar]
Vague PRC laws to keep information behind closed doors may increase companies' liability.
[Sidebar]
Quick Glance
* China's ambiguous definition of state and commercial secrets poses risks for foreign companies.
* Firms should enact strict compliance policies and training programs to prevent accidental exposure to secrets.
* Companies must understand state secrets law before entering into agreements with Chinese state-owned enterprises.
[Author Affiliation]
Mitchell A. Silk (mitchell.silk@newyork.allenovery.com) is a partner and Jillian S. Ashley (jillian.ashley@newyork.allenovery.com) is an associate with Alien �r Overy in New York.
