The Chinese Government is Accessing YOUR Network Through the Backdoor and There Still is NO Place to Hide

Home | China Law Blog | The Chinese Government is Accessing YOUR Network Through the Backdoor and There Still is NO Place to Hide The Chinese government and its state controlled banks have worked hard over the last decade to "digitize" financial reporting and procedures. These days, a business operating in China virtually never needs to visit a Chinese government agency office or a bank. Transactions and reporting are done online. For normal daily operations, this means all of the following are done through the Internet: Day to day banking Monthly tax reports Monthly tax and social insurance payments Issuance of VAT tax receipts Periodic reports to government agencies For importers/exporters, reporting to customs If you try to do this kind of work through the old fashioned method of personal visits to the various Chinese government offices, you will be turned away. All this appears to be modern and efficient. But this extensive use of the Internet conceals a hidden danger. In all these transactions, Chinese government agencies and the banks require the business make use of software provided by the agency or the bank. No independent software is allowed. This software is usually a package that includes connection software and anti-virus protection. In my experience, these packages are poorly written, buggy, slow and difficult to use. When installed on many businesses' central computer, they slow operations to the point of being unusable. But the real issue runs deeper. As I have discussed in earlier posts, the goal of the Chinese government is to make information networks in China closed to outsiders but completely open to the Chinese government. See China’s New Cybersecurity Program: NO Place to Hide and China’s New Cybersecurity System: There is NO Place to Hide. As I said in both of these posts, there is no place to hide. Once on the Internet, the information will be accessed by the Chinese government. To state the matter more clearly, the Chinese government has become the most active information hacker in China. So when a business installs the required software on its systems, this software is being provided by a hacker. The risks are obvious. In response to these two posts, many of our readers "suggested" we not be "so negative" about this hacking because "some of us still need to do business in China," but nobody has questioned our conclusion regarding the risks. The reality of the risk has recently been exposed by Trustwave, a U.S. based cybersecurity consultant, in its report on a case where malware was included in software required by a Chinese bank for payment of taxes. See The Golden Tax Department and the Emergence of GoldenSpy Malware, subtitled, Trustwave SpiderLabs has discovered a new malware family, dubbed GoldenSpy, embedded in tax payment software a Chinese bank requires corporations to install to conduct business operations in China. The basic story is typical of China. The bank requires installation of its mandated software created by a private "big data" Chinese company working under contract with the Chinese national tax department. In other words, the mandate requiring the use of this spyware comes straight from China's national government in Beijing. The software contains a backdoor that takes two actions. First, all data submitted to the bank and all other data on the host computer is transmitted to a server owned by a private Chinese company connected with China's national tax department. This server is housed on the AliBaba cloud. Second, the software allows the operator of the backdoor complete access to the entire host computer system. Trustwave provides standard advice on best practices for dealing with this type of infection. Their advice to remove the software is, however, simply not practical, since companies are required to use this spyware to do business in China. Their alternative is to install the software on a dedicated laptop that is fully insulated from the main company computer system. This approach prevents infection of the main company network system. However, it does not prevent the private data transmitted to the local tax authority from being transmitted to the malware server to be used for undisclosed purposes. It also is not clear how the Chinese government will treat a foreign company that isolates its exposed data to a sole, non-networked computer. So now we know why all this Chinese government mandated software works so badly. The software is so filled with malware, backdoors and surveillance protocols that normal operation is slowed to the point of making many systems unusable. Those of us who work in China have always assumed this and now the Trustware report provides a concrete example. The larger issue is that this forced installation of backdoor malware is a constant issue in China. It is not just the case of one piece of software from one bank. As this case shows, the national government works with government controlled banks, local governments, private software/big data companies and Chinese based cloud service providers to implement a system that allows total access to all information available on the networks located in China. It might be possible to implement protections against one single piece of malware, as Trustware advises. But as a practical matter, it is impossible to implement protection against the constant and pervasive measures the Chinese government takes to access private company data. There are too many points of access. For example, government mandated inspection of company networks allows for installation of similar backdoor malware as part of the inspection process. The issue is not simply the compromise of the China based system of foreign investors. Once the China system is compromised, the hacker (Chinese government) can almost always then gain access to the entire international network linked to the hacked system. The infection spreads from China around the world. Informatization, big data and full spectrum dominance is the Chinese government's highest priority. If you operate within China's borders, there is no place to hide. This has important implications for companies operating in China and this reality must be carefully assessed. Check Out Our China Law Services Share Twitter Facebook LinkedIn E-mail Comment China Law Blog The China Law Blog focuses on the practical aspects of Chinese law and how it impacts foreign companies that do business in or with China. The goal is to help readers understand what works and what does not work and what businesspeople can do to use the law to their advantage. China Law Blog's aim is to assist businesses already in China or planning to go into China, not to break new ground in legal theory or policy. Harris Sliwoski Blog Read more posts [email protected] Read More AI, Internet, Web3, and Blockchain Related Posts September 15, 2026 Your AI-Drafted China Contract Says It Needs a Lawyer. Listen to It. September 11, 2026 Forensic Accountants in China Business Litigation: How True Numbers Can Tell the Wrong Story September 4, 2026 China NNN Agreement or Trademark Registration? You Usually Need Both September 1, 2026 AI Didn't Replace Lawyers. It Gave Us the 48-Page Contract. August 27, 2026 Do I Need a China NNN Agreement or a China Manufacturing Agreement? Usually Both. August 26, 2026 China’s New Overseas Investment Rules: Can Your Chinese Investor Actually Get the Money Out? August 24, 2026 International IP Protection for Startups: What to Protect and Where August 19, 2026 The Documents Are the International Deal August 19, 2026 China Supplier Fraud in Yiwu: Why We Recommended the Police, Not a Lawsuit August 17, 2026 China Trademark Registration: Why U.S. Companies Need More Than a Filing Agent August 10, 2026 Buying Expensive Equipment from China: Seven Questions to Answer Before You Pay August 7, 2026 DDP Shipping Risks: What Boise Cascade’s Guilty Plea Means for U.S. Buyers August 6, 2026 Protecting Your Artwork Internationally: What Artists Need to Do Before the Work Travels August 5, 2026 Your China Employee Signed the Vacation Policy. You Can Still Lose. July 29, 2026 The RedNote Contract Lesson for Companies Doing Business in China Leave a comment Cancel reply