Deceptive safety

An Italian woman walking home in the middle of the night near Beijing's trendy Chaoyang Park bar area was stabbed to death on July 25.

The incident, rare as it is in China, raised a few eyebrows and made a few small headlines but did not get much widespread attention beyond that. It did not stir loud calls for better security, nor did it generate any kind of panic. Some weblogs mentioned it in passing and foreign embassies issued standard recommendations that people – particularly women – avoid walking alone in the middle of the night.

After all, when people talk of security in China they tend to refer to benign thefts, intellectual property protection or firewalls for online systems.

But that view may not be entirely accurate, particularly as the country's economy develops, traffic between cities grows and the gap between rich and poor expands.

"China is a bit misleading, people expect it to be very safe," said Dane Chamorro, director of the Hong Kong office of Control Risks Group, an international security company.

By and large, foreigners are still as safe in China as anywhere. Punishment for hurting or killing foreigners is quick and swift. Western executives, particularly from multinational corporations, are often doubly safe both because of their ethnicity and the visibility lent to them by the corporations they work for.

Ethnicity issues

But the same may not be true of their Chinese-born or ethnically Chinese colleagues, especially those born in Hong Kong or Taiwan. First of all, there are quasi-legal detentions or kidnappings engineered by business competitors who use police agencies as effective business tools.

"Police do come into things at the instigation of business," said Jerome Cohen, a law professor widely considered to be one of the top experts on Chinese law. "That is an element of risk but usually with people of Chinese descent."
Violent crime – an area where, unlike in a number of other Southeast Asian nations, China's law enforcement agencies are reasonably effective – also becomes an issue of ethnicity. A Chinese returnee or an ethnically Chinese executive may not enjoy the same protection based on the fear of quick retaliation from the authorities.

As a result, these executives may face more risks when traveling in China. Shenzhen, in particular, has earned a reputation as an unsavory place where muggings and purse snatchings – typically by would-be robbers on motorbikes – are on the rise.

"If the media is anything to go by [business killings] are happening more and more. At least, they are reported more and more," said Chamorro.

Perhaps slowly, awareness of potential risks is spreading. Insurance companies have begun taking stock of this market and offer products tailored to companies that do business in China. International insurer Chubb has a product that offers small and medium-sized enterprises this type of specialist coverage, according to insurance broker Danny Yao of Risk Management Group.

"I think there is a demand, especially if they have Hong Kong businessmen going into China," Yao said. "As more expats are going in there will be a demand."

Despite the growing awareness, corporations often ignore these risks, taking a reactive approach when something happens. And more things are happening, which is perhaps unsurprising given the growing number of Chinese millionaires, who tend to be popular ransom targets.

Business extortions are common. Security companies say some large corporations receive hundreds of extortion letters a week threatening to, for example, poison products of well known brand names in exchange for cash.

Internal controls

But these security concerns, serious as they might be on the surface, represent a small fraction of the actual threats facing corporations operating in China.

Security lapses are more often driven by the growing desire to keep up with expensive lifestyles and that means theft and corruption are the more likely risks for corporations operating in the country.

In response, China's corporations are spending an increasing amount of money on insurance, with expenditure in this area rising 30% per year, according to the International Insurance Society.

On the other hand, corporations with stringent security procedures overseas are sometimes more lax in China, preferring instead to focus on the more obvious necessity of safeguarding their intellectual property. The result is that internal security poses a bigger risk than external threats.

Many of these risks are directly related to computer networks and the lack of upgrades, checks on employees and a culture that has little respect for IP.

Given the ease with which an employee can walk away with sensitive information on a USB key or simply e-mail it directly off the premises, companies need to spend hundreds of thousands of dollars on systems that protect sensitive information. New science parks offer sterile environments intended to prevent spying but many corporations have little in the way of processes.

"Is information classified according to the level of sensitivity? I have yet to find an international corporation doing that," said Chamorro.

Smaller companies are less likely to be aware – or willing to spend money – on prevention than larger ones and this makes them vulnerable, particularly in terms of online security.

According to a 2005 study by Accenture, 55% of companies in China say complexity of online security systems is one of the main causes getting in the way of better systems. At the same time, some 53% said their employees lacked awareness of potential risks.

Ironically, a very high percentage of respondents, 78%, were aware of the risks.

The study also found that protection measures that work in the US or Europe don't necessarily work in China, begging the question of whether rules need to be adapted to match cultural preferences.

The loose and easy attitude towards theft of intellectual property in China may be linked to these cultural differences.

Professor Philip Chan of Hong Kong University of Science and Technology said earlier this year that employees often feel ownership of what they produce. From there, it's not much of a stretch to actually copying files onto a USB key or walking away with a proprietary design into the ether of China's countryside.

"How are you going to find this person? It's a big country," Chan said.

What's more, given the proclivity for corruption in China – the country came in at the halfway mark in Transparency International's annual corruption survey – it is not beyond the realm of possibility to envisage two or more employees working together or one employee paying another one to look the other way on a theft.

Best practices needed

Another considerable security risk – and one that could also be traced back to cultural roots – stems from fraud, whether it's an employee lying on a resume or embezzling millions.

Ironically, most fraud cases can be prevented by putting in place a system of best practices.

Preventative measures are fairly straight forward. Security experts recommend being aware of who works for the company and making sure the proper checks are in place to monitor staff, visitors and vendors. Furthermore, it is important to have somebody in place to carry out oversight on these practices and ensure compliance.

These simple checks can go a long way to preventing rather than reacting to threats. The problem in China, however, is that most companies overestimate the level of security and wait until after something happens to put measures in place.

"Once they have an issue they try to resolve it," Chamorro said. And that is often too little too late.