China’s internet ID push signals a new era of digital control

On July 15, China passed new legislation known as the National Network Identity Authentication, also called Internet ID.

Under this new law, Chinese citizens would voluntarily enroll via a government app, submitting their true name and a facial scan, after which they would be issued a unique ID code used for all online accounts. As of May, approximately 6 million individuals had already obtained IDs during the pilot phase.

Based upon the nature of the control the Chinese Communist Party has over media and censorship, it is not surprising the Chinese government desires the ability to track its population during their internet sessions, especially those citizens who would be critical of the current regime or dissidents that are living outside mainland China.

The new Internet ID law expands on an ongoing digital authoritarianism agenda pursued by China in recent years. Already, the Chinese government has demonstrated its growing capacity and willingness to monitor its citizens' online activities. 

From the widespread usage of internet backbone filtering through the “Great Firewall” to the mandatory real-name registration implemented since 2010, Beijing has increasingly restricted avenues for anonymous speech online. The new ID system is designed to further tighten the government’s grip on cyberspace at an individual level.

This law would enable the Chinese government, enabled by the new digital ID system, to centralize user identities in a government-controlled database, allowing authorities to track which user fronts which online account, even if platforms only see the anonymized token. 

This approach applies nation-state censorship in a more individualized way and introduces the possibility that content may be filtered or platforms blocked for certain users, both within China, where the government manages internet access, and potentially on a broader scale. 

It could allow the Chinese government to use filters and blocking mechanisms within a platform to limit access to certain services associated with a personalized digital ID for specific individuals.

While the legislation claims to be voluntary at launch, many fear that adoption could gradually become mandatory. In China’s regulatory environment, the “voluntary” label has frequently functioned as a transitional stage before compulsory enforcement. 

Authorities have encouraged social media giants, e-commerce platforms and even payment providers to begin integrating the Internet ID into their user authentication flows. If access to essential digital services becomes dependent on possession of this ID, individuals may find their ability to function online is effectively contingent upon submitting their biometric and personal data to the state.

This law is just the next step in China’s desire for digital authoritarianism, enhancing the government’s ability to surveil, monitor, shape and control a population down to the individual citizen level. 

The digital ID system also complements other previously designed surveillance systems, such as Sharp Eyes, police cloud systems, facial recognition closed-circuit television systems and grid-style social management, allowing the Chinese Ministry of State Security to link online activities directly into national monitoring systems. 

The digital ID system also complements broader data-localization and true-name tracking policies first enacted in 2017 under the Cybersecurity Law and fortified under the Personal Information Protection Law of 2021.

The Chinese government will argue that the system protects its citizens from fraud or other cyber-related crimes and is voluntary, but that voluntary argument fails the reality test, based upon mandatory aspects of previous digital legislation. This new digital ID system erodes the anonymity already curtailed by China’s real-name registration laws from 2010. 

The other cybersecurity risk that a centralized database creates is the one-stop honeypot of data that, if compromised, could be catastrophic to the Chinese population, not unlike the past leaks of over 1 billion sensitive biometric records in 2022.

Looking ahead, the introduction of China’s Internet ID is a decisive move further away from digital anonymity, putting powerful surveillance and censorship tools in the hands of the authorities. 

If history is a guide, this technology may not remain voluntary for long. Its effects on privacy, civil liberties and the freedom of expression within and beyond China's borders could be profound. 

As more platforms adopt mandatory digital ID checks, Chinese citizens face an even more controlled and surveilled internet for years to come.

James Turgal is the former executive assistant director for the FBI Information and Technology Branch and Optiv Security’s vice president of cyber risk, strategy and board relations.