CHINA'S REVISED WEB POLICIES

Anu: Hello, everyone, and welcome to today's webinar, All You Need to Know About China's Revised Web Policies. My name is Anu Shah and I will be your moderator.

Joining us today is Gretchen Olive. Gretchen is the Director of Policy and Global Domain Name Services for CSC. For nearly two decades, Gretchen has helped Global 2000 companies devise global domain names, trademark, and online protection strategies and is a leading authority on the ICANN new GTLD program. Welcome, Gretchen.

Gretchen: Thanks, Anu.

Anu: So, folks, we'd like to kick things off with a poll question. We'd like to know how many of you have domain names hosted in Mainland China. Shortly, you'll see a poll question, the poll on your screen. We'll give you all a few moments to make your selections and then we'll share the results with the group.

Gretchen: So, while we're waiting for some people to respond here, welcome, everybody. Thank you for spending some time with us here today. China has definitely been a hot topic and the changes that are going on there.

We had really full session this morning with lots of great Q&A, so I really encourage everybody to share their questions or their comments in the chat box, as Anu stated earlier. Really, these sessions are for you, so please let's make sure you get out of it what you're hoping to learn.

Here are the results of our poll question. So, it looks like we have a good percentage of folks who have got some domain names that are hosted in Mainland China, so this will be a very relevant webinar for you.

We're going to spend the session really focusing on those new domain name registration rules of China. But before we get there, we're going to start with a little information about the internet landscape in China to give you a sense of what is going on there in terms of the users. We're also going to talk about Chinese policy of Cyber Sovereignty. That may be a new phrase for many people, but we'll explain that.

As I mentioned, we'll then go into the regulatory changes affecting domain registration. We'll talk about ICP filing and licensing. We'll go through some special considerations, what I call the top FAQs I get as I've been talking with clients over the last several months about these changes in China. And I guess to round it all out, throughout we'll explain how CFC can help.

So, again, please put your questions in the chat box. We'll get to them as we can. If we don't get to all of them during the session, we will do an outreach afterwards directly to you to work through those questions. Without further ado, let's talk about some of these statistics.

These statistics are as of the middle of last year, so July 2017. First of all, there are 751 million internet users in China. That's a huge number. To give you some context, that is greater than all of Europe, the number of internet users in all of Europe. Further, the internet penetration rate was 54.3%, so we've tipped over now. Fifty percent of the population in China is actively utilizing the internet.

Now the three provinces where we see the greatest internet penetration are Beijing, Shanghai, and Guangdong. So, keep that in mind. They're at internet penetration rates of about 74%.

Also, in China, I think a lot of people know this, but it stands mentioning, the number of mobile internet users in China rose by a little over 28 million during the first half of 2017. So it's now reached 724 million. That's really how most internet users in China navigate. It may not be their sole means of navigation, but it is their primary means of navigation.

Mobile users also accounted for over 96% of total internet users, and that was up from 95.1%. And then mobile online payment users continue to grow. These numbers are from 2016, but they continue to grow and reached 469 million, an increase of 31.2% year-over-year.

So, you can really see this is a very hot space. Many companies, particularly in the west, are trying to figure out how they enter the market in China. How do they connect with those consumers? An obvious channel is the online channel, and that's why I think a lot of companies over the last five years have been making slow moves, very careful moves, to an online presence in China at the very least, if not some formation of entities, and even in some cases, a partnership, affiliation agreements, etc.

But in 2017, we really saw China start be more assertive in terms of pursuing a policy of what's called Cyber Sovereignty. This is something that you may have heard China's president, Xi, mention several times in different addresses and speeches that he's done over the last couple of years. It's really this sense that all countries should have the right to regulate the internet within their own borders.

So, for those of you who are regular attendees of some of our other digital brand services webinars, you may be familiar I do a series after each ICANN meeting…ICANN is the Internet Corporation for Assigned Names and Numbers. They meet publicly three times a year, and CSC participates in those meetings. As part of those meetings, we have seen over the last 10 years a drive toward increasing the number of TLDs online. So in 2012, there was the big application period for new GTLDs. And we started seeing them launch at the end of 2013 and then in earnest in 2014 and 2015.

And there's still some launching. In fact, we've got launches coming up for dot-app and dot-dev starting in late March. So, I know that's a highly anticipated…Dot-app in particular is a highly anticipated TLD.

But nonetheless, as this evolution online has occurred with this increase in the generic namespace, and that's what ICANN is responsible for governing, many countries have come to the table through a group called the Governmental Advisory Committee, which is part of the overall ICANN community. They come to the ICANN meeting to share with the ICANN board and the community at large the individual country perspective on these new policies that are being worked on to expand the internet space.

And over the last five years particularly, the governmental Advisory Committee and the participants in that, which are typically ministers and assistant ministers from the different telecom agencies within these countries, they have been coming and pretty much saying, "ICANN, I'm not comfortable with you coming up with the rules of how the internet operates in my country and how it affects my citizens."

China is really taking the lead and really is out front on this Cyber Sovereignty positioning. I think 2017 was a real example of the types of policies that they're pursuing to drive this strategy. I'll give you some examples here. This is by no means meant to be an exhaustive list.

In January of last year, the Ministry of Information and Technology, called the MIIT, released a notice and basically put people on notice to say, "Internet access service market, you need to clean up your space. You have to make sure that your customers and your practices are doing all the right things, that you're adhering to the policies, that you're making sure that everybody is following the rules, has the proper licensing, etc."

They put everybody on notice that by March of 2018, the end of March of 2018, they should get that work done, which somewhat signals…Not just somewhat, but really signals that after that, the government intends to take pretty significant enforcement action. So that's going out to ISPs, and hosting providers, and other infrastructure providers, putting them on notice. Make sure people are abiding by the rules of China.

In June, a new cybersecurity law went into effect. There's not a day that doesn't go by across the global landscape where we're not hearing about security threats online, data breaches. It's a very hostile environment right now.

Technology has been embraced by many industries, both public and private. With that has come some sacrifices in terms of privacy. Certainly, Europe has been very out in front with data privacy particularly. I know many of you are aware and are gearing up for the beginning of enforcement under the General Data Protection Regulation, or the GDPR, where the data privacy rules in Europe are more uniform and will extend out beyond Europe in terms of applicability.

But in June of 2017, China passed this new cybersecurity law, which very much tried to tighten up their security procedures, policies, and data protection rules in an effort to try to lock down the environment more and protect their citizens.

And then in November, we had the new regulations on the administration of internet domain names. That's the effective date. It was announced slightly before that, but the effective date of those changes to domain registration went into effect on November 1. And it was a further tightening of the procedures in terms of registration, who could host, what you needed to do, what eligibility criteria you needed to meet to be able to host web content in China. We'll flesh each one of these out, but certainly, 2017 in my eyes was a year of Cyber Sovereignty in China.

So, let's talk about MIIT. That is the telecom industry agency in China. That notice that I mentioned that they sent out in January, they really put all Virtual Private Networks, or VPNs, which allowed Chinese internet users to access blocked overseas websites, on notice. They will have to be authorized by telling telecom regulators in the U.S.

Further internet infrastructure providers, as I mentioned, should make sure all client website licenses are in place and operating in scope by the end of 2018. So, again, a little bit more detail on that notice out, but this has clearly been a priority.

Then the new cybersecurity law that went to effect in June, as I mentioned, requires all network operators to store select data within the boundaries of Mainland China and allows Chinese authorities to conduct spot checks on the company's network operations. So, that's a big jump. That's a big change. Basically, China is asserting that the law is intended to bring China in line with global best practices for cybersecurity and data protection, and again, in a lot of ways, looking at this cyber security law as their GDPR.

Then what I really want to focus on today is those new domain name administrative regulations that came in November. So, they were announced, in all Chinese, in September of 2017. I give you a little link there where you can actually link to the source document. But under these new regulations, any domain name registered through either a registrar based in China or a registration of a domain name hosted within Mainland China must meet the following requirements.

First of all, the domain has to be a top-level domain that has been approved by the MIIT. You see a reference there to a list, and we'll get to that in a second. Let me explain this a little bit.

So a lot of people think that the domain name registration regulations that went into effect in November were for dot-cn. There are subdomains in there like dot-com-dot-cn. It is much broader than that. The application of those changes really has impact on all TLDs.

And what the regulation requires…There was actually some regulation that happened earlier in 2016 and then this brought it all to fruition. It requires that all the TLDs, the registries for the individual TLDs, get licensed by the MIIT. So in effect, the regulation made it illegal for Chinese-based registrars to sell and manage domain names and TLDs that were outside of the list of the approved TLDs.

Now this list is growing. There are under 50 at this point. I think we all know there are about 1,300-odd GTLDs out there alone, not to mention CCTLDs. There's only a small set of TLDs, but we're starting to see the pace of approvals or licensing of the individual TLDs increase. Just at the top of the year, we got word that they're about 21 or 24 that were approved. So, this is a process that's really starting to take shape.

One of the things that often does happen in this space in China is the regulations, or they call them measures, are promulgated at that MIIT national level, but the actual implementation and enforcement is pushed down to the local level, down the provincial level. You have local agencies, called Communications Bureaus, that are actually responsible for implementation and enforcement.

What we saw here is that many of them were not prepared for licensing. So, the registries do get licensed at the MIIT level, but all that process was not in place yet. And then also the locals weren't ready to let the registrars know which TLDs they could provide. So, it's been a little bit of a slow go, but they're starting to gain steam now.

Also, the second bullet here talks about the domain name has to be registered through a registrar that's been licensed by a local provincial arm of that Communications Bureau of the MIIT.

Now there was actually a specific provision in the draft of this regulation that spoke very clearly to this. And in fact, the impact of that draft language set panic out across the globe. Many people felt it was China saying, "No one from outside of China can register domain names." In fact, in policy discussions we've had here at CSC with representatives at MIIT, they were shocked to learn that that's the way it was interpreted. The U.S. Department of Commerce issued a response letter to that. It was quite a big deal.

But that was not what they were intending. They really wanted to make sure that the registrars that were selling domain names that were either going to Chinese citizens or were hosting content within China were being regulated, were being licensed. That was really their intention.

So, they actually took this language out of the domain name registration rules. And what happens is you actually see it in applications in getting an ICP license, which we'll talk about in a little bit, to host content in China. So, it's not explicitly written in the domain name registration rules, but it needs to be the case to be able to host content in China. We'll talk a little bit more about that, but just to give you that insight.

And then we have the registrar for the domain name has to successfully complete something called the Real Name Verification at the time of registration. So, some of you who have domain names currently in dot-cn may remember back in 2010, CNNIC, which is the registry operator for dot-cn put this Real Name Verification process in place. What its intention is to validate the existence, the validity, the authenticity of the entity or the person registering the domain name.

The domain industry is a very self-service industry. Certainly, here at CSC, we have a full-service model. Most of our clients work closely with a client service partner who does the work on their behalf and under their instruction. But a lot of other domain name registrants will just simply go to web portal, put credit card information in, and they'll register a domain name all by themselves. And quite honestly, in the past, WHOIS information was not always accurate because you could self-serve and put in what you wanted.

There was one point in time early on in my career where I think Mickey Mouse was the number one registrant across the globe. I always used to laugh at that statistic, but it was true.

So, that is something that every registration that happens under this new rule, if you get it through a Chinese register or you're purchasing a domain name to be hosting content in China, it needs to go through this Real Name Verification process.

And then lastly, the registrant hosting the domain name within Mainland China must obtain an ICP provider number. So, that's what that ICP is, Internet Content Provider number, to display on the domain name's website on the home page in the bottom footer.

We had a question earlier I think where people said, "Well, what exactly does that look like?" And really what it looks like is there are a couple of Chinese characters to designate the province from which the license or the number was issued, it says "ICP," and then it has a string of numbers.

So, it really is something that, in the past, was requested be done, but it was difficult to enforce. Now it's required. So, you must have an ICP number on the bottom of your website.

Now let's talk about for a minute…you're going to see a chart of the approved MIIT TLDs that I talked about in that first bullet. So, we talked about there are some…MIIT now needs to license each registry or TLD operator for them to be either sold by registrars in China or for them to host content in China. These are the only TLDs right now that are authorized. This was as of February 1.

Like I said, the list is growing and it's getting a little faster, but it's important that you're really clear that this new Chinese domain registration policy does not only impacts dot-cn and things like dot-com-dot-cn, but just reinforcing it affects all TLDs.

You'll see the com and net. I know I worked with customers over the last several months talking about the names that they do host content on within Mainland China. It's typically a dot-cn or dot-com-dot-cn name or dot-com or dot-net name. So, I do see a fair amount of those as well. Just to let you know, it's affecting com and net as well.

Anu: We have one question that came in.

Gretchen: Absolutely.

Anu: Roger is asking, "I'm a French company. Do I have to transfer my domain names to a Chinese company to get an ICP to use websites in China?"

Gretchen: Very good question. So, the short answer is that if you're a client of CSC, you can work with CSC to get that done. We're currently in line to get our license. We've been in line for just about a year now, a little over maybe at this point, to get our license. There have only been a very small handful of Chinese-based registrars that have been licensed so far.

We're working with a Chinese registrar partner that we can manage the name through for you on your behalf, so you don't need to go find someone. Just work with us and we can make sure that that happens for you so you can get your ICP number.

Let's carry on and we'll continue. I continue to see questions come into the queue, so don't be shy. Continue to send those in, but we'll take those as we go.

So, the next thing, I want to just drill into a little bit more on ICPs. As I mentioned, ICP stands for Internet Content Provider. There are two types of ICPs. There's a filing, sometimes referenced as a recordal. They also have Chinese names, and I'm going to admit my Chinese is off, so we're going to stick with English in this case. There's also a commercial license, and we'll talk about that on the next slide. But let's first focus on the filing.

So as you saw in an earlier slide, every domain name where content is hosted within China needs to have an ICP number. This is the first thing you would do. You would get an ICP filing. Everyone must have this ICP filing regardless of whether the website is commercial or non-commercial. If you have a site with just information, brochureware, you still need an ICP filing.

You are not allowed with just an ICP filing to engage in direct online sales. The website should be used only for informational purposes. So, that's what an ICP filing will do.

Now let's turn to an ICP commercial license. This allows online platforms or third-party sellers of goods and services to deploy their website on a hosting server or CDN, a Content Development Network, within Mainland China.

So, if you want to use a CDN or something like that, and/or you want to launch a website with e-commerce or online payment integration, you must get the commercial license. You're going to need both the ICP filing and the ICP license.

What's really important to understand is the filing generally takes up to 20 days. I've seen it take as little as five to seven, but I think as kind of time goes on and there's a lot of activity going on, as people become more and more aware of these regulations, you'll probably see them creep up closer to 20. The ICP commercial license will take substantially longer, generally three to six months. So just keep that in mind, the timeframes, as you proceed down this path.

These ICPs are typically…You typically will work with your hosting provider to get those applications in. Now that's something that CSC intends to offer in the very near future. We don't yet offer these services, the filing and licensing services, but we will certainly keep you apprised of when we are able to provide those services. But in the meantime, we can certainly help guide you through the process and understand what's going on.

I will tell you that a lot of the calls that we're on are where our clients might have a local subsidiary or an affiliate that handles everything that they do online in China. Partially, the language is easier for people in country who speak the language to manage. The time difference is a big challenge for some. So, typically, those folks will be getting information whether they be from hosting providers or other market players, like registrars or consultants, etc.

And then there's also some stream of information that will come in direct from your hosting provider. And sometimes when you look at those two sets of information side by side, they don't exactly match. They don't seem to link. What we find ourselves doing a lot, because we have pretty wide line-of-sight here and we're working with a lot of customers across the globe, is we're able to help connect the two.

So, we can generally help you understand the process, and then we can also help you understand if…Sometimes it's more a misunderstanding of languages used. That's different. That doesn't quite match up. Each party is giving you the right information. It just doesn't seem like it at first all. But we have found many instances where you're getting bad information from one of those sources, and we usually can help get you back on track.

But you would work with your hosting provider at this point to get that done. Some of those hosting providers outsource to third-party companies also to do that.

One thing you have to shy away from now is, in the past, a lot of these hosting companies were able to apply for the ICP in the company's name to get you the license. That can't happen anymore because they're not actually the website owner. It needs to be you, your organization. So, that's where the part comes in about the applicant for an ICP cannot be a foreign entity. It must be a Chinese company. So, that's where the registrant needing to be a Chinese company or individual comes in. If you apply for your ICP using a Chinese company or individual, the applicant of the ICP must exactly match the registrant of the domain name.

So, this is where it gets a little challenging. This is going forward. There's transition going on in terms of existing registrations into this new world. But for anything new that you're doing, this is the requirement. If you're going to get an ICP for a site, you're going to want to make sure the registrant of the domain name exactly matches what you're going to list as the applicant of the ICP.

And when I say exactly match, it means down to the character set that's used. So, if it's in Chinese characters on the business registration certificate, that's exactly what you should be using on your ICP application. That's exactly what you should be using as the registrant of the domain name.

So, it's certainly a lot of new information to digest. It's a little confusing. As I mentioned earlier, there are a lot of market players that in some instances are giving bad information. You may have gotten phone calls, emails, letters, calls from your local subsidiary affiliate telling you, "We're being told we need to move our entire portfolio to China," or, "We're being told that everything needs to be hosted in China now." That is not the case. These rules only apply to domain names that you are hosting in Mainland China or that you have registered through a Chinese registrar.

Hopefully, the case is you have all your names with CSC, and then you only have to worry about the ones where you want to host the content in China. Again, we have a solution for you.

If you have domain name elsewhere, you need to look at that. And I would even suggest to give us a call and we can help you get that consolidated so that you're working with one party to guide you through all this, because it can be quite confusing.

I see the questions piling up in the queue. Anu, what do we have?

Anu: Let's take one from Caroline Sullivan about what we just discussed. She's asking, "Can you repeat that? The ICP applicant must be a Chinese entity and also match the registrar and the domain name exactly?"

Gretchen: That's correct. Think of it as…I call it the trifecta. So, when you apply for an ICP, you need to apply in the name of a Chinese company or individual. In the case of a Chinese company, which I would guess most people on the line here today is what they would want to apply with using one of the Chinese entity they have. And I would suggest an entity, if you have it, in Shanghai. It's a very business friendly Province in China, particularly to western companies. I'd pick a Shanghai company.

But that ICP applicant, that applicant company, you will list what's listed on the business registration certificate for that company as the applicant exactly as it appears on your business registration certificate. Then that ICP applicant needs to also match. So, the business registration certificate and the ICP applicant match, and then that also has to match with the registrant of the domain name. That's very important.

Going forward, there's going to be some kind of grandfathering for a period of time on existing registrations, and that period of time is a little unclear how long that will go on for. But for anything new, that's what needs to be in place.

Anu: Laquita is asking, "Does the legacy GTLDs means they can no longer be purchased or used?"

Gretchen: So, the legacy GTLDs…And when I say legacy, I want to make sure we're all talking about the same thing, so dot-com, dot-net, dot-biz, dot-info, all those. They can still be purchased. In fact, they have gone through the licensing process. And on that grid that you saw a few slides ago, you saw a small list of the legacy TLDs. That's not the new GTLDs, but the legacy GTLDs that have gone through the licensing process and can be purchased from a registrar within China.

All legacy GTLDs can be purchased outside of China. Registrars outside of China like CSC do not have any restrictions in terms of being able to sell those TLDs. But you will be restricted on whether or not you can host content within Mainland China on TLDs that are not approved by MIIT. I know that's a lot to take in, but that's the logic.

Anu: We definitely have a lot more questions coming in.

Gretchen: May we take one or two more, and then we'll do a few slides and then we can get back to questions after that.

Anu: Josh is asking, "Do we need to create a Chinese company if we do not have one?"

Gretchen: Likely, yes. One of the things I want to just caution everybody on is we're talking very generically here. Everything is a case by case and facts are important. So, don't run out and set up a Chinese company based on this webinar alone. We should probably talk. I'm going to even recommend that you can consult with your counsel, obviously, because we can't provide you with legal advice, but we can certainly share our experience. If you're going to want to host content in China, you're either going to probably want a Chinese entity or potentially have some kind of licensing agreement in place with someone who might.

Anu: Let's take more and then we'll…

Gretchen: Sure.

Anu: Michelle's asking, "Is there a downside to having a dot-cn domain name and website posted outside of China? Will they not be accessible from within?"

Gretchen: No. This can be confusing. So, first of all, one of the reasons it's important…if you want to have content accessible to Chinese residents, citizens, if you do not host the content within Mainland China, so you host it outside Mainland China, it is still visible, but the resolution of the website, meaning how quickly the website comes up in a browser, is really slow. So, one of the reasons people host content within Mainland China that is targeted toward the Mainland China audience is to significantly improve website resolution.

So, domain names in dot-cn, or dot-com-dot-cn, or any TLD can be visible within China, but if they're not on the TLD that's approved by China, they won't be visible likely, and the website content will come up very slow if it's not hosted within China.

Let's carry on a little bit here. So, let's talk about what I call special consideration, some of the things I think…We could probably talk about this…I know I could easily talk about everything going on and the different permutations for probably several hours. There are a few situations that I've been asked quite a bit about over the last couple of months as we've been helping clients through this, so I thought I'd highlight a couple best practices and a few things to think about. So, that's how I would categorize these special considerations.

Let's start actually from the bottom first. I'm going to start with asset inventory. I think one of the biggest challenges that companies have had with these new rules is that, while they're very clear as to who their registrar is and who they have the name registered through, they are very clear as to who their DNS provider is for the names, and they may even be very clear if they use perhaps a content delivery network, a CDN, in China, they might know who that is, but that's usually where it breaks down.

So, they might know they use a Content Delivery Network globally, but maybe not specifically China. They might not know who in China they specifically use. Companies may not know what URLs within their portfolio of domain names are hosted in China.

So, that's where it gets super confusing. When or if you get some kind of compliance notice, there's a bit of a fire drill to identify the assets that are actually being hosted in China.

After you leave this webinar, I would say one of the first things you should go and do is identify every URL that is hosting content in China. I use URL as opposed to domain name very deliberately. Let me explain.

Often, you'll have a domain name. I'm going to use the example CSCGlobal.cn. Let's just use that. We may have a special microsite that we use for Chinese companies, and maybe the URL for that microsite is China.CSCGlobal.cn. So, it's really important that you know to that level what pages, what microsites, on domain names that you manage and own are hosted Mainland China. One, you need to be aware of them. Two, you need to know what root domain name they track back to.

Again, going back to the example, CSCGlobal.cn is the root domain name, and that China.CSCGlobal.com is actually a server configuration off the root domain name that routes traffic to that specific area on the server to serve up the China content.

So, you want to make sure you know the root domain names and the URLs off those root domain names where the content is hosted in China.

You can do that right within domain manager using the user defined fields. So, if you don't know how to do that, certainly please reach out to your CSP, or your Strategic Account Manager. We can set that up.

You could put the ICP number, you could the hosting provider, you could put maybe a contact internally. So, you can have that information along with the domain name so that you have an inventory of that. Certainly you're going to need to keep that up. We do not have any insight as to where you are hosting these names. We provide DNS hosting, but we do not provide web hosting. So, that's really important to understand. Asset inventory, put that on your list of things to do.

Second is more of something you should tell your organization. If you do have websites, you have content that's being hosted in Mainland China, you should make sure that everyone within your organization that would be involved in that understands that if any kind of compliance notice comes in about that root domain or that URL, how to route that.

What I've seen time and time again over the last several months is where the person who actually is going to do something about that compliance notice doesn't get the notice until many days, sometimes a week or so, after that notice actually gets received by the company in China.

Compliance timelines are usually very quick. They're short. They're not weeks and weeks. They're days typically. So, it's really important that you put your team globally on notice, especially your team in China, that whoever is on those ICP applications, whoever is currently listed in the domain names, the admin and email is being used, all that information is going to come your way. It also may come postal mail. Again, really important. That will help limit delays.

Why don't we pause for a quick second there? Those are a couple of best practices. Then I'm going to talk about a few other things.

Anu: David is asking, "We are a U.S.-based company with a Chinese-registered corporation name. Does that count as a Chinese company?"

Gretchen: No. It needs to actually be formed in China. It could be something called a WOFE, one of my favorite acronyms. It's a Wholly Owned Foreign Entity. So, it just needs to be more than, I believe, 51% of ownership in China. It needs to be a company formed China.

Anu: Martin is asking, "Is it possible to register a dot-cn domain with a non-Chinese registrar and thus avoid the ICP requirement?"

Gretchen: You're not going to avoid the…You can register a dot-cn name with CSC currently, not a licensed registrar in China. You can you can register it with us. That domain name will work, but if you want to host content on that domain name in Mainland China, then you're going to need an ICP number. If you post content on it outside of the U.S., it will resolve in China, but it will be very slow.

Anu: Mark is asking, "International businesses with offices in China connected by corporate VPN. Do you sense there is any risk to the continued visibility of those VPNs?"

Gretchen: I won't rule out any risk, but I think the corporate VPN, no. The personal VPN, certainly, that was part of the cybersecurity law that came into effect on June 1. That's was really limiting those personal VPNs. There's a lot of trickery has been happening in the past to bypass what they call the Great Firewall of China through those personal VPNs. But so far, it looks like corporate VPN is fine.

Anu: We'll take some more questions, but we're also going to put another poll question on this screen for the audience.

Gretchen: I can talk to the others while we're keeping the poll question up here. So, let me just mention a couple of other things. I'm going to start with the one URL strategy challenges. So, as I work with a lot of companies that are global, a lot of them have this one URL strategy, which in the past has been great. You drive all your traffic to your main web property, and then you run microsites and other things off of there, but all that traffic comes to one place.

In our example from earlier, CSCGlobal.com, we try to drive everything there. And we may have a country-specific microsite underneath that URL, whether it be through a subdomain like the example I had, the China.CSCGlobal.com, or you may run directories on the back of the domain name, so you'd have CSCGlobal.com/China, or something like that. That's been very popular.

But I think it's important to understand that that may be a risky strategy as it relates to China. Let me explain what I mean by that. So, if we use that example of China.CSCGlobal.com, the root domain there is CSCGlobal.com. We run lots of country-specific pages off that and lots of other stuff, product specific, and all sorts of things off that main root domain name.

But if I want to host content in Mainland China on China.CSCGlobal.com, to get the ICP license, I'm going to need to transfer my domain name to a licensed Chinese registrar. With CSC as a partner, we can we can handle that for you. We're standing in line, I think, as I mentioned earlier. We're waiting for that to come through. But in the meantime, we have a solution where we work with a partner and can manage that name for you through our partner on your behalf.

So, we could move that to our partner, but then what happens is we get an ICP number, we're going to have to change the registrant of that domain name from CSC Global here in Wilmington, Delaware, to an entity we may have in China. So, now we're going to start diverting the ownership of our domains to other subsidiaries within our corporate family. The ICP is going to be made in that that company name also. So, we're going to put the ICP license in that company name. They're going to get all the notices and all the information on that.

Now let's pretend there's something on that China.CSCGlobal.com website, which is only one page among thousands of pages off that CSCGlobal.com URL. But there's something on that China.CSCGlobal.com URL that is a problem for the MIIT, for the Chinese government. It's offensive. It's out of compliance for some reason.

What can happen is they can go to the hosting provider and say, "Just take down that one page," or they could go to the registrar and say, "We want you to deactivate the DNS." Now that's a bigger problem because that DNS is for your entire global web presence. That's the DNS hosting that's then going to send it to the server box that will tell you where to find different content around the globe depending on the URL that you're hitting off the CSCGlobal.com domain name.

So, you can see how putting everything into China will then potentially under that one URL strategy subject your entire global web presence to the rules of China. Probably not something your organization is going to be super comfortable with.

So, I think that really deserves a business discussion within your organization to understand if maybe now is the time to break off China from that one global strategy. Maybe you put it on…In our case, we could put it on CSCGlobal.cn or CSCGlobal.com.cn and run all our China stuff off that, so that if something happens in China, it only affects our web properties hosted out of China.

I often get asked the question, "Is this just a one country thing? Is this just China doing this?" Right now, yes, but not for long. There are other countries, often referred to as the BRICS countries that typically follow suit, that are very interested in this rollout. They're watching very closely how China does this because they, too, adhere to the belief of Cyber Sovereignty, that they should have the ultimate control over what happens in their country's cyberspace.

So, Russia, I would put my…I put a little bet on Russia to be next. I think Brazil, India, and potentially Iran are not far behind. So, that's that one URL strategy issue.

WeChat I have up there because I know a lot of companies are using WeChat and the microsites available on there as sometimes their first entry into web online in China. You can't have one of those without an ICP number. So, you're going to have to follow all the rules here to be able to do that.

And then I'm trying to remember the last thing that was on my slide there, but I think I may have covered all.

Anu: That was it.

Gretchen: I think I covered them all. So, we've got the poll question up there. I think there are a couple questions. We can probably squeeze maybe one or two of them in.

Anu: Yes, definitely. Gretchen, thank you. That was great. Folks, the question on the screen is, "Do you want CSC to contact you about getting compliant under MIIT's new policy?" You can select how you'd like to be contacted. Just a reminder, you can download a copy of today's material from the resource widget.

Gretchen, Ed is asking, "We have a global assets only, movies, images, fonts, dot-com domain accelerated in country by ChinaCache. Do we need to create an index.html displaying our ICP number even though it's not providing HTML pages to customers?"

Gretchen: That's a very detailed question. We had a couple of those in the morning. I think those are ones that really warrant a conversation. There's a lot of Q&A we're probably going to need to go through. I can give you information based on my experience as far. This is new to everybody. We're all making our way through the forest. I certainly will recommend also that you would consult your own counsel for any legal advice and obviously your technical group. I'll take that question as an offline question and reach out to you directly on that.

Anu: Great. Roger and Dawn have similar question. "If someone is already doing e-commerce in China under dot-cn TLD, are the ICP filings required as well?"

Gretchen: Yes.

Anu: Then Roger says, "If I understand all, MIIT wants us to work only with Chinese registrars. Domain names must be transferred to a Chinese entity."

Gretchen: No. That's sort of how the policy was initially read, and that's why they took the language out of Clause 37, because that's the way it came across. They want jurisdiction. That's what they want. And they want the registrars, the hosting providers, and the registrants to all be following the rules.

So, we expect to be licensed very quickly. We've gone through quite a number of steps already. So, I anticipate that will happen in short order. But again, we can manage those names for you. You don't need to move it to…You can work with CSC and we can manage that for you in the interim.

Anu: Great. Folks, that is all the time we have today. If we didn't get your question, we will contact you with the response after the webinar. Thank you to everyone who joined us. Thank you, Gretchen. We hope to see you next time.