NEW SCOOP from @zachsdorfman: China's Ministry of State Security has demanded that private Chinese companies, including Baidu and Alibaba, help them process stolen U.S. data, such as from the OPM hack, U.S. intelligence officials

Zach writes, "In what amounts to intelligence tasking, China’s spy services order private Chinese companies with big-data analytics capabilities to process massive sets of information that have intelligence value, according to current and former officials."
“Just imagine on any given day, if NSA and CIA are collecting information, say, on the [Chinese military], and we could bring back seven, eight, 10, 15 petabytes of data, give it to Google or Amazon or Microsoft, and say, ‘Hey, we want all these analytics," said one official.
It's hard to overestimate the significance of this intelligence assessment.

There has been speculation that Baidu, Alibaba, and Tencent might have ties to China's security state. In fact, they work directly with them and for them—because they have to. According to US intel.
If you have been enjoying this series of scoops from @zachsdorfman, also take some time in your day to appreciate the skill and dedication that FP editor @BeijingPalmer has put into them.
These are the intel assessments that the Trump admin has been going on. This helps explain many of the policies that the Trump administration has taken regarding growing restrictions on private Chinese companies.

Just yesterday, we saw this from DHS:

https://t.co/d7wrQQlZNV
So ask yourself — if this U.S. intel assessment is correct, what kinds of policies should the US adopt regarding allowing Baidu to operate data research centers in the US?
But that's not all. Zach writes: Based on “high-confidence reporting,” the CIA concluded that the Chinese tech giant Tencent, which operates the ultrapopular WeChat messaging service, received funding from the Ministry of State Security early on in its foundation.
Tencent strenuously denies this.
And a reminder, before anyone shit-posts about sourcing, that Zach spoke with more than *three dozen* current and former officials for this series. The info presented in these articles aren't the random claims of a handful of people. We're talking more than 36 people verifying.

More from World

You May Also Like

Recently, the @CNIL issued a decision regarding the GDPR compliance of an unknown French adtech company named "Vectaury". It may seem like small fry, but the decision has potential wide-ranging impacts for Google, the IAB framework, and today's adtech. It's thread time! 👇

It's all in French, but if you're up for it you can read:
• Their blog post (lacks the most interesting details):
https://t.co/PHkDcOT1hy
• Their high-level legal decision: https://t.co/hwpiEvjodt
• The full notification: https://t.co/QQB7rfynha

I've read it so you needn't!

Vectaury was collecting geolocation data in order to create profiles (eg. people who often go to this or that type of shop) so as to power ad targeting. They operate through embedded SDKs and ad bidding, making them invisible to users.

The @CNIL notes that profiling based off of geolocation presents particular risks since it reveals people's movements and habits. As risky, the processing requires consent — this will be the heart of their assessment.

Interesting point: they justify the decision in part because of how many people COULD be targeted in this way (rather than how many have — though they note that too). Because it's on a phone, and many have phones, it is considered large-scale processing no matter what.