Translation: China's 'Cybersecurity Threat Information Publication Management Measures (Draft for Comment)'

TRANSLATION

[Chinese-language original]

Notice from the Cyberspace Administration of China regarding publication and seeking opinions on the “Cybersecurity Threat Information Publication Management Measures (Draft for Comment)”

In order to standardize the publication of cybersecurity threat information, effectively respond to cybersecurity threats and risks, and ensure the secure functioning of networks; on the basis of relevant laws and regulations such as the "Cybersecurity Law of the People's Republic of China"; the Cyberspace Administration of China, in cooperation with the Ministry of Public Security and other such relevant departments, has drafted the "Cybersecurity Threat Information Publication Management Measures (Draft for Comment)," which are hereby made public in order to solicit opinions. Relevant work units and individuals from all walks may submit opinions before December 19, 2019, through the following methods:

1. By sending an e-mail to: security@cac.gov.cn.
2. By sending a letter with the opinion to Cyberspace Administration of China Cybersecurity Coordination Bureau, 11 Chegongzhuang Dajie, Xicheng District, Beijing Municipality 100044, and indicating "Cybersecurity Threat Information Publication Management Rules Opinion Solicitation" on the envelope.

Cyberspace Administration of China

November 20, 2019

Cybersecurity Threat Information Publication Management Rules (Draft for Comment)

Article 1: In order to standardize the publication of cybersecurity threat information, effectively respond to cybersecurity threats and risks, and ensure the secure functioning of networks; and on the basis of the "Cybersecurity Law of the People's Republic of China" and other such relevant laws and regulations; these Measures are formulated.

Article 2: The publication of cybersecurity threat information shall occur with the goals of safeguarding cybersecurity, stimulating an increase in cybersecurity consciousness, and exchanging technical cybersecurity protection knowledge. It may not harm national security or the societal public interest, and it may not infringe the lawful rights and interests of citizens, legal persons, or other organizations.

Article 3: When publishing cybersecurity threat information, the principles of objectivity, truth, caution, and responsibility should be upheld. Cybersecurity threat information is not to be used to engage in speculation, to gain improper benefits, or to engage in improper commercial competition.

Article 4: Published cybersecurity threat information may not include the following content:

1. the source code and production methods of malicious code such as computer viruses, trojans, and ransomware;
2. programs or tools especially used to engage in attacks against networks, interfere in the regular functioning of networks, destroy network defense measures, steal network data, or otherwise harm networks;
3. detailed information that enables the complete repetition of the process of a cyber attack or cyber intrusion;
4. the content itself of data leaked in a data leak incident;
5. plans and designs, topology, asset information, or software source code of specific networks; or proprietary information regarding unit or equipment selection, deployment, software, etc.;
6. cybersecurity risk assessments, inspection and certification reports, or security protection plans and schemes of specific networks and information systems; and
7. other content that may be directly used to harm the normal functioning of networks.

Article 5: Before the publication of information about cybersecurity incidents where network and information systems are attacked, destroyed, subject to illegal intrusion, etc., the incident is to be reported to public security office at the district-, city-, or higher-level in the location where the incident occurred. All levels of public security offices should promptly report the relevant circumstances to the same level's cybersecurity and informatization department and the higher-level public security office.

Article 6: Any enterprise, social organization, or individual should, when publishing a comprehensive analysis report about a regional cybersecurity attack, incident, risk, or vulnerability, first report the matter to the local district-, city-, or higher-level cybersecurity and informatization department and public security office.

When publishing comprehensive analysis reports on cybersecurity attacks, incidents, risks, and vulnerabilities that involve public telecommunications and information services, energy, transportation, water supply, finance, public services, e-government, national defense science, technology, and industry, and other such important sectors and areas, they should first report the matter to the sector's competent department.

When publishing comprehensive analysis reports on national, cross-regional, or cross-sectoral affairs, they should first report to the national cybersecurity and informatization department and the State Council public security department.

Article 7: When any enterprise, social organization, or individual publishes cybersecurity threat information without approval and authorization from government departments, the title may not contain the term "early warning."

Article 8: When publishing risks and vulnerabilities existing in specific network and information systems, the written opinion of the network and information system operator shall be sought in advance, except in the following circumstances:

1. where the risk or vulnerability concerned has been eliminated or repaired; and
2. where the matter has been reported a minimum of 30 days earlier to cybersecurity and informatization, telecommunications, public security, or relevant sectoral competent departments.

Article 9: Where information is published through the following platforms, the platform operator or sponsoring work unit shall, where they receive reports from relevant departments or users, or themselves discover that acts of publication or published content violating these Measures have occurred on the platform, immediately cease publication, adopt deletion and other such measures to handle the matter, prevent the spread of infringing content, preserve relevant records, and report the matter to the district-, city-, or higher-level cybersecurity and informatization department and public security office.

1. periodicals, radio and television, and publications;
2. Internet sites, forums, blogs, microblogs, public accounts, instant messaging tools, Internet streaming, Internet audiovisual programs, applications, online hard drives, etc.;
3. publicly organized conferences, forums, or lectures;
4. publicly organized cybersecurity competitions; and
5. other public platforms.

Article 10: Where cybersecurity threat information is published in violation of the provisions of these Measures, the cybersecurity and informatization departments and public security offices will handle the matter on the basis of the provisions of the "Cybersecurity Law of the People's Republic of China."

Article 11: Cybersecurity threat information publication activities involving state secrets and secret networks will be regulated according to relevant state regulations.

Article 12: Cybersecurity threat information as addressed in these Measures includes:

1. With regard to acts that may threaten the regular functioning of networks, information used to describe their intention, methods, tools, processes, results, etc. Examples: computer viruses, cyber attacks, cyber intrusions, cybersecurity incidents, etc.
2. Information that may reveal network vulnerabilities. Examples: system vulnerabilities, risks or vulnerabilities existing in networks and information systems, proprietary information such as network plans and designs, topology, asset information, software source code; attributes of unit or equipment selection, deployment information, software, etc.; and cybersecurity risk assessments, inspection and certification reports, security protection plans and schemes, etc.

Article 13: These Measures take effect on the date of promulgation.