US rethinks data protection policies
Biden sounds alarm on possible risks from Chinese vehicles and tech
From genomic information to internet-connected cars, the United States is rethinking its data protection policies – with further trade curbs aimed at China in the cards – as tech like AI brings new risks.
In the past week alone, President Joe Biden took steps expanding Washington’s national security toolkit, sounding the alarm on possible risks from Chinese vehicles and tech, a day after issuing an order to limit the flow of sensitive personal data abroad.
The fear is that such data can be used to track citizens, including those with sensitive jobs, or train artificial intelligence models.
The use of sensitive data to develop AI could allow adversaries to use the tech to target US individuals for espionage or blackmail, such as by recognising patterns across datasets to identify people whose government links would be otherwise obscured.
Washington has started to recognise the “strategic and national security value of data”, said Lindsay Gorman, senior fellow at the German Marshall Fund of the United States.
She noted that the Commerce Department’s investigation into risks from Chinese tech in connected vehicles is “a long-overdue look into the application layer of the future internet”.
“We should expect further investigations into the data produced across the internet of things,” she said.
The moves signal “broader concerns about national security risks emanating from unfettered free access to data,” said Emily Benson of the Centre for Strategic and International Studies (CSIS).
Until now, Chinese firms could legally buy US data in bulk, noted Martin Chorzempa, senior fellow at the Peterson Institute for International Economics.
This creates an “imbalance”, he said, adding that the latest order closes a “loophole”.
Washington has tried using national security grounds to limit foreign firms’ ability to buy American companies and access US data – but businesses could still acquire the information.
A Duke University study published in November found that it is not tough to get sensitive data about active-duty military members, with information available via data brokers for as low as 12 cents per record.
“Overall what we do see is the recalibration of the United States’ approach,” which has traditionally leaned towards free dataflows, said Benson, director of CSIS’s project on trade and technology.
“That era seems to be behind us,” she told AFP.
The approach to data comes as
Washington mounts a broader push to power economic growth and maintain a US lead in tech competition with China – while putting up national security guardrails.
A key factor is AI, which can quickly analyse and manipulate bulk data in carrying out espionage or cyber operations.
“A part of this is a foundational security approach to reining in certain high-risk AI capabilities,” Benson said.
Concurrently, Washington’s need to stay ahead in AI has spurred other federal policies such as the Chips Act, which pours US$39 billion into manufacturing incentives.
Last Monday, Commerce Secretary Gina Raimondo said AI has been a “game-changer” in demand for advanced chips, adding that the US can eventually house the entire supply chain for producing such semiconductors.
Most global semiconductor manufacturing capacity is currently in China and East Asia, according to the US Semiconductor Industry Association.
“China has been very proactive at building out its own data protection and data security regime,” said Chorzempa.
“One element of that is restrictions on what data can be transferred cross-border,” he added, noting that foreign companies would not necessarily be able to get data from China on its citizens.
US moves represent it coming more aligned with data governance regimes of its close partners, Benson of CSIS said.
The European Union has strict data protection laws including its 2018 General Data Protection Regulation, and rules covering the flow of bulk commercial data between devices.
Japan has been pushing for the flow of data while ensuring trust in privacy and security as well.
“It’ll be interesting to see to what degree (American action) actually facilitates greater convergence among regimes, or whether we’re into unchartered territory when it comes to digital governance,” said Benson.