Lao Dongyan: My Views on Internet IDs and Internet Certificates (Full Text)
The "Administrative Measures for National Cyberspace Identity Authentication Public Services (Draft for Solicitation of Comments)" (hereinafter referred to as the "Measures"), jointly drafted by the Ministry of Public Security and the Cyberspace Administration of China, was officially released on July 26 and is currently soliciting public comments. Since it is open for comments, I would also like to publicly express my personal views.
The core meaning of the "Measures" is the preparation to promote the network ID number and network certificate system. In my view, such initiatives not only contain extreme social risks, but also completely lack the basis of superior law. Compared with the relevant content of the first review draft of the previously proposed "Law on Administrative Penalties for Public Security", the social risks can be said to be even worse.
1: The "Measures" do little to strengthen the protection of citizens' personal information, and their real intention is to strengthen the control over individuals' words and deeds on the network.
After twelve years of implementing the real-name registration system for the network, with more than one billion netizens, their personal information has been mastered by various network service providers. Under this circumstance, how much practical significance can the promotion of the network ID number and network certificate system have for protecting personal information? When the network real-name registration system was initially launched, it was also claimed to be based on protecting the personal rights and interests of citizens, but I am afraid the actual effect is obvious to all.
This means that the real intention behind the launch of the network ID number and network certificate system is to strengthen the control over individuals' words and deeds on the network. The so-called strengthening of the protection of personal information is just a feint, or at least not the primary purpose. As a result, such a situation may be formed: in the real space, everywhere is covered by cameras plus facial recognition, while in the virtual space, network ID numbers are used for tracking, and network certificates are used to control people's behavior in using the network.
2: The essence of the network ID number and network certificate system is an upgraded version of the Health Code.
Metaphorically speaking, the network ID number and network certificate system are similar to the Health Code, and they are cut from the same cloth in terms of governance thinking, except that the application of the Health Code is normalized and used for the governance of normal society. Such normalized application is undoubtedly worse than the Health Code during the epidemic in terms of social risk, and the network ID number and network certificate system can be said to be an upgraded version of the Health Code. Almost all the various problems that appeared in the use of the Health Code back then may be staged again in a similar form.
The promotion of the network ID number will enable all traces of individuals on the network (including browsing traces) to be easily and comprehensively collected, which is equivalent to installing a surveillance and tracking device for everyone's internet access. The introduction of the network certificate system means that accessing the internet and using various services of network service providers essentially become a franchise that requires approval to enjoy. Once relevant departments do not allow individuals to use the corresponding authentication services, the right of individuals to use the network will be restricted or even deprived, losing freedoms such as speaking, commenting, and obtaining information on the internet.
3: The network ID number and network certificate system are tantamount to infinitely expanding criminal investigation measures originally aimed at suspected criminal personnel to apply to all ordinary individuals.
Tracking the traces of specific individuals on the network belongs to the field of criminal litigation investigation measures. The use of such investigation measures obviously needs to meet the dual requirements of substantive law and procedural law in the criminal field. However, the network ID number and network certificate system are equivalent to allowing the tracking of traces of individuals on the network without any illegal or criminal suspicion of ordinary individuals and without fulfilling any approval procedures, and restricting or even depriving them of their behavior in using the network.
Such restrictions and deprivations obviously violate the principle of legal reservation. The current laws, whether the "Cybersecurity Law", the "Data Security Law", the "Personal Information Protection Law", or the "Anti-Telecom Fraud Law", are difficult to serve as such normative bases. It is worth pointing out that the promotion of the network real-name registration system has a legal-level basis, but unifying the real-name authentication method through network ID numbers and network certificates has no basis in superior law at all. The "Measures", simply as departmental rules and in the absence of a basis in superior law, lack basic legitimacy in introducing the network ID number and network certificate system.
4: Although the "Measures" mention the principle of voluntariness, they fail to provide basic guarantees for the realization of the principle of voluntariness. Considering the reality that the principle of voluntariness is easily hollowed out in the Chinese context, this principle also finds it difficult to provide a legitimate basis for the network ID number and network certificate system.
Article 7 of the "Measures" stipulates the principle of voluntariness, which seems to help dispel criticism against it. The problem is that the realization of the principle of voluntariness requires effectively ensuring the voluntariness of the two subjects, that is, network service providers can voluntarily choose to use the identification through network ID numbers and network certificates as one of the authentication methods, and users are also given the freedom to choose other authentication methods. However, judging from the lessons learned from facial recognition, the principle of voluntariness is easily hollowed out, especially if relevant departments advocate or even require network service providers to conduct identity authentication through network ID numbers and network certificates. Such advocacy and requirements are almost unavoidable in practical operation, otherwise there would be no need to issue the "Measures".
This can also be seen from paragraph 2 of Article 3 of the "Measures". This paragraph stipulates that the State Council's departments of civil affairs, culture and tourism, radio and television, health, railways, postal services, etc., according to this measures and relevant laws and administrative regulations, are responsible for the promotion, application, and supervision and management of the national cyberspace identity authentication public service within their respective scopes of duties. With the lessons of facial recognition in the past, the principle of voluntariness actually serves as nothing more than an excuse to shift risks. Given that it is difficult for the parties involved to have a true awareness of the risks after informed consent, and that the principle of voluntariness is easily hollowed out and circumvented, while the parties involved are extremely difficult to obtain effective relief, it is obviously impossible to expect the principle of voluntariness to provide a legitimate basis for the network ID number and network certificate system.
In summary, I believe that introducing the network ID number and network certificate system in the form of departmental rules lacks basic legitimacy, clearly has the suspicion of exceeding authority, and it is necessary to submit the content of the "Measures" to the Constitution and Law Committee of the National People's Congress for constitutional review.