Security of western company data held at data centres in Hong Kong is under a cloud

The security of western business information held in dozens of data centres in Hong Kong faces review as China tightens its grip on the once British-run colony.

Protesters hold up blank papers during a demonstration in a mall in Hong Kong on July 6. Picture: Getty Images

The security of western business information held in dozens of data centres in Hong Kong faces review as China tightens its grip on the once British-run colony.

Data centres in Hong Kong are being urged to review the security arrangements surrounding customer information with the passing of China’s imposed national security law.

The law give authorities increased power to crack down on dissent and opposition, and allows the formation of a China-operated national security agency in the territory.

However there is concern the law will let China-backed law enforcement in Hong Kong gain access to data held privately by western companies there.

That concern has seen Facebook, Twitter and Google parent Alphabet suspend processing requests for data by Hong Kong law enforcement in light of the law, according to The Wall Street Journal.

However dozens of data centres are also likely to be impacted.

Last night, Microsoft, which operates a data centre in Hong Kong, told The Australian it would suspend assisting law enforcement there.

“As we would with any new legislation, we are reviewing the new law to understand its implications,” a Microsoft spokesperson told The Australian.

“In the past, we’ve typically received only a relatively small number of requests from Hong Kong authorities, but we are pausing our responses to these requests as we conduct our review.”

Yesterday social media app TikTok announced it would quit the Hong Kong market altogether, citing the new law.

TikTok is owned by Chinese company ByteDance, so it would be difficult for TikTok to refuse law enforcement requests. If it agrees to data requests and collaborates with the Chinese government, support for TikTok in western markets would evaporate. If it refuses the requests, it would be in trouble with China’s new law.

TikTok took a third option which was to exit the Hong Kong market altogether. It faces further pressure with US secretary of state Mike Pompeo confirming that the Trump administration was considering banning Chinese social media applications including TikTok. Banning China social media apps would impact other well-known services such as WeChat, Weibo and instant messaging app Tencent QQ.

TikTok was the platform used by teens in the US to organise a mass buy-up of seats at the president’s rally in Tulsa, Oklahoma, rendering them unavailable to Trump supporters and contributing to a poor crowd turnout there.

However the security of company data including possibly trade secrets belonging to western nations held on dozens of western run data centres in Hong Kong takes the issue beyond the security of billions of videos and memes propagated by TikTok.

US firms Rackspace, Microsoft, Zenlayer, Equinix, Wowrack, Enzu and Digital Reality and Japan’s NTT Communications are among a list of Hong Kong data operators. China Mobile and China Telecom also operate centres there.

Robert Potter, CEO and founder of online security firm Internet 2.0, said data centres and cloud service providers operating in Hong Kong should review the security of customer information stored there, and whether the information should be transferred to another location.

“I think a lot of the more advanced cloud service providers will have established business continuity plans (BCPs) for jurisdictional changes,” Mr Potter said. “A lot of them will have encountered similar circumstances before when the ownership structures of their data centres changed.

“For example, there was a data centre in Sydney, which was bought out by a company that was not particularly well trusted by the Australian Government. As a result of that purchase, a lot of the cloud service providers activated their existing BCP plans to migrate their data out of those data centres.”

Mr Potter said he agreed with the interpretation that the passing of China’s national security laws made data stored at centres in Hong Kong more vulnerable to government requisitioning and interference.

“That’s a fair interpretation. It is existing practice within Chinese law on the mainland to force companies to co-operate with intelligence collection if they operate within the jurisdiction of China.

“Until the Chinese government provides some sort of interpretation around how the new laws impact on various sectors of the Chinese government in Hong Kong, it would be prudent to take a broader interpretation and to manage the risk.”