International firms caught in China’s security Web

A group representing international companies in China has warned members that police in Beijing, Hebei and Shandong have required international firms to purchase Internet monitoring devices or risk having their connections cut.

The Quality Brands Protection Committee (QBPC), a group aimed at safeguarding intellectual property rights in China, sent an email to its 216 members late last month warning of the police visits, saying it “would cause serious concerns from our members.”

The emailed alert, copies of which were provided to CNN, raise particular concerns for international businesses operating in China because many companies often use private networks that allow employees to skirt China’s so-called “Great Firewall” of censors. But, based on the QBPC alert, it appears firms in some areas are being asked to install a device within their private systems to track all internet activity– and that information must be made available to police, looking for “illegal activity.”

“It has come to our attention that three of our QBPC members reported that local police units in Beijing, Hebei and Shandong approached them, forcing two members to purchase Internet security software from the police designated suppliers,” wrote Ron Davis, chairman of the QBPC membership services committee, in the email obtained by CNN.

“Reportedly, if they failed to do so, the police threatened to cut off their Internet connection and fine them.”

Another QBPC member company received a questionnaire from the local police unit asking about its Internet security measures, according to the QBPC email. “Given that if the local PSB (public security bureau) initiative were carried forward, it would cause serious concerns from our members, we are attempting to determine if any of our other 200-plus member companies have faced this same situation or know other member companies who have,” Davis wrote.

The email doesn’t detail which companies were targeted. The QBPC membership represents a broad swath of international firms with operations in China, including technology companies like Apple, Nokia and Emerson, consumer product makers such as Anheuser-Busch, Procter & Gamble and Colgate-Palmolive, and automotive companies Toyota, Audi and Volkswagen AG. Time Warner, the parent company of CNN, is also a member.

Davis has confirmed that he sent the email obtained by CNN. A spokesperson for QBPC said, so far, the group has received 15 replies from its members. Three member companies were asked by police to install internet logging equipment and two reported police requests to inspect their internet security measures. The others reported no contact from police.

QBPC wouldn’t name the members who were approached. “The three companies are in different industries,” the spokesperson said. “Based on the members’ response, it seems the police visits are isolated incidents.” QBPC has reported the incidents to the Ministry of Commerce and “had informal discussion with various departments of the MPS (Ministry of Public Security).”

Thomas Parenty, an information security specialist and former employee of the U.S. National Security Agency, said the devices could be used to spy on foreign companies and creates industrial espionage concerns.

“From an information security perspective, something like this in place in a company’s network could be used for exploratory attacks into the network itself,” Parenty said. “It’s a Trojan horse that fits in a computer rack.

“If you’re concerned about IP (intellectual property), you might as well roll up your tents because it’s essentially game over,” Parenty said.

Copies of Shandong province police orders provided to CNN require companies to purchase the equipment from one of two equipment providers, Netbox Info-Tech and Shanghai Pronetway. Shanghai Pronetway could not be reached for comment. When CNN called Netbox’s sales center in Jinan, the capital of Shandong province, a man who identified himself as Zhao– but declined to give his full name or position– said the company is cooperating with the Shandong Public Security Bureau and providing devices to cities around the province.

Zhao said many Chinese companies have received police notifications and have purchased the equipment, including a number of foreign joint venture companies, but he declined to name them.

The Shandong order notes that businesses “are often used to disseminate pornography and superstitious information, online fraud and gambling, or used by hackers to jeopardize national security and people’s intere