Office of the State Commercial Cryptography Administration, PRC Cryptography Law (Draft for Comments)

The state evaluates the security of the application of cryptography for critical information infrastructure by category and grade and, in accordance with state requirements for security reviews, conducts security reviews of cryptographic products, cryptography-related services and cryptographic security systems that affect or could affect national security (Article 18).

As required for national security or for the investigation of a criminal offense, the people's procuratorate, public security authority or national security authority may, in accordance with the law, require a telecommunications service operator or internet service provider to provide decryption technology support. The telecommunications service operator or internet service provider shall offer its cooperation and keep the relevant matters confidential (Article 20).

The state protects cryptography-related intellectual property in accordance with the law (Article 22).

issued:2017-04-13

Issued: April 13 2017

Main contents: The state divides cryptography into core cryptography, ordinary cryptography and commercial cryptography and administers them based on such categories (Article 7), and sets forth protection requirements in respect of cryptography by category. Core cryptography and ordinary cryptography may be used to protect state confidential information and commercial cryptography may be used to protect information other than state confidential information (Article 10).

The state implements control over the import and export of cryptography. The export of core cryptography and ordinary cryptography is prohibited. The State Council department in charge of commerce and the state commercial cryptography authority implement licensing for the import and export of commercial cryptography in accordance with the law (Article 16).

The state promotes the development of a cryptography testing and certification system, and will formulate cryptography testing and certification rules (Article 17).

The state evaluates the security of the application of cryptography for critical information infrastructure by category and grade and, in accordance with state requirements for security reviews, conducts security reviews of cryptographic products, cryptography-related services and cryptographic security systems that affect or could affect national security (Article 18).

As required for national security or for the investigation of a criminal offense, the people's procuratorate, public security authority or national security authority may, in accordance with the law, require a telecommunications service operator or internet service provider to provide decryption technology support. The telecommunications service operator or internet service provider shall offer its cooperation and keep the relevant matters confidential (Article 20).

The state protects cryptography-related intellectual property in accordance with the law (Article 22).

issued:2017-04-13