By Craig Robinson

Over the past two weeks, we’ve all heard many different opinions on the Google-China dispute. It seems everyone who’s anyone has sounded off on the political implications of Google’s announcement to stop censoring search engine content. Amid all the soapbox shrill, too many are forgetting about the incidents leading up to Google’s decision and the serious downstream questions about national security these incidents raise.

In the U.S. today, our most vulnerable data is housed in the private sector. While mandates like SOX, HIPAA and PCI helped create standards within certain industries, few global infosecurity standards and regulations govern how sensitive enterprise data is transferred and stored. In the absence of comprehensive guidelines, business and IT leaders are left to their own devises when it comes to implementing effective cyber security policy, strategy, and technology. While the current extent of the breaches is debatable, the implications of major breaches and security incidents at some of the country’s most progressive technology companies—Google, Yahoo!, and Adobe—where policy, strategy and technology are thought to be topnotch, are huge. Preparation for potential actions like those attributed to China recently is a necessity for businesses. Our adversaries are paying attention and next time the stakes may be much higher than access to search engine content.

The Policy Perspective
Playing by host country rules is a business decision. Leaders must understand the risk management aspects of conducting international business—a crucial component of which is to explicitly consider threats to the business operations. This consideration is especially important when a company is conducting business outside of its country of origin.

By American standards, China has a longstanding, adversarial stance on freedom of speech that “telegraphed” (in advance) their potentially drastic actions while investigating human rights activists. China’s actions can be considered a form of cyberwarfare. Official US sources (including the Congressional Research Service) have reported that China has openly discussed cyberwarfare capabilities. Such capabilities are applicable to civilian and military targets, especially as evidenced by China.

Any company, including Google, can choose to enter a market if their lawful business interests and activities drive such a decision. However, companies must also understand the potential direct threats (e.g., from cyberattacks) and indirect threats (e.g., adverse public opinion) that may result from such business operations. Google is an international giant. If a behemoth with global influence can suffer from direct attacks, other businesses must take note and address their policies accordingly.

The Strategy Perspective
Strategy provides the top-level framework for implementing policy. If companies are to enter an environment with potential state-sponsored cyberwarfare threats, they must develop, in advance, their business strategy. The “tit for tat” adjustment (by Google) of access controls may have been implemented in accordance with a preplanned strategy. However, China likely has a capability to escalate cyberwarfare to an extent that Google may not fully appreciate. In either case, China certainly has the capability to make business operations untenable for companies refusing to “play by the local rules.”

Business strategy must account for likely contingencies, like this, that threaten policy objectives. In the Google example, pre-planned strategy could have included establishing (in advance) lines of communication within the Chinese government to allow for cooperative resolution of disputes. Suspending or ceasing business operations in China, if no agreement is reached, could be a strategy of last resort. Jousting with the Chinese government in cyberspace is an approach that even Google found problematic.

The Technical Perspective
Businesses, regardless of the geographic extent of their operations, must implement the technical measures necessary to reasonably assure their operations are in accordance with their strategies. From a practical perspective, it is extremely difficult for any corporate business infrastructure to withstand a cyberattack conducted or supported by a “cyber superpower.” Even outside of the cyber realm, China has proven itself capable of shutting down the basic network connectivity, and other infrastructure, that allows a business to operate within its territory. These realizations provide the clearest proof points for the necessity of sound policy and strategy that align with technical realities.

For more on this topic, check out this recent article by Jim Lakely in InfoTech & Telecom News.