Cybersecurity & Tech Foreign Relations & International Law

After Didi Fiasco, China Imposes Cybersecurity Reviews on Foreign IPOs

Abby Lemert, Eleanor Runde
Thursday, July 15, 2021, 2:21 PM

Lawfare’s biweekly roundup of U.S.-China technology policy and national security news.

Bob Zhang, co-founder of Didi Chuxing, presenting at a tech convention in Hong Kong. (RISE,; CC BY 2.0,

Published by The Lawfare Institute
in Cooperation With

Chinese ride-sharing giant, Didi Chuxing, launched on the New York Stock Exchange on June 30, quickly raising $4.4 billion—the largest initial public offering (IPO) of a Chinese company since Alibaba in 2014. But the launch apparently surprised Chinese regulators, who reportedly thought they had put the brakes on by warning the company not to move ahead with the IPO. When Didi’s stocks began trading as scheduled, Beijing reacted quickly, announcing that it was cracking down on the company’s cybersecurity practices and prohibiting the company from accepting any new users in its mostly China-based market. New Chinese regulations rolled out in the wake of Didi’s disastrous launch mandate cybersecurity reviews to ensure the safety of user data before Chinese tech companies will be allowed to go public overseas.

On July 2, the Cyberspace Administration of China announced that it was placing Didi under investigation over data security concerns and ordered app stores to remove Didi, preventing the company from acquiring new users. After the measures were announced, the company’s freshly issued stock tumbled more than 30 percent in four days. Didi indicated that it had no knowledge that such a crackdown was coming.

Commentators believe this is a strong signal of China’s intent to “discourage listings of Chinese tech companies in the United States,” which some see as “the last brick of the digital Berlin Wall” separating the Chinese internet from the global internet.

The State Council also announced a set of new cross-border data security regulations. The regulations will apply to any Chinese firm with more than 1 million users. Those companies that exceed this threshold will be “required to undergo a cybersecurity review,” including potential ramifications of data transfer for Chinese national security (including “risk of supply chain interruption” and the risk of data being “maliciously used by foreign governments”), before conducting an IPO in markets outside China.

The new audits and restrictions are expected to affect primarily foreign data use. This set of rules comes on the heels of China’s Data Security Law, which promised additional oversight of data sharing and hefty punishments for those who breached cross-border data transfer rules. This includes sharing information with foreign law enforcement authorities.

This latest move lends credence to a growing consensus that Chinese regulators are keen to keep their monopoly and control over the user data collected by their homegrown companies. Viewed through that lens, the new cybersecurity reviews are a continuation of Chinese regulators’ broader crackdown on “platform” companies, whose currency is Chinese user data. However, Zou Xiaodong, vice president of the China Academy of Information Security and an important voice in Chinese cybersecurity regulation, says the move was neither sudden or unpredictable, nor related to U.S.-China decoupling—it was simply the natural outgrowth of China’s maturing data governance regime.

U.S. investors faced major losses from the Chinese crackdown, as Didi’s valuation tumbled from $70 billion to $57 billion on July 7 and dropped another 7 percent before markets opened the following day. On July 9, Chinese regulators ordered the removal of 25 more apps linked to Didi from Chinese app stores. As the entire Chinese tech sector continues to slump, U.S. policymakers have called for a Securities and Exchange Commission (SEC) investigation into whether investors were misled by statements from the Chinese company. Some reporting suggests that Didi, despite its protestations to the contrary, knew about the Cybersecurity Administration of China’s data security concerns before its market debut.

Republican Sen. Marco Rubio said that allowing Didi to trade in U.S. exchanges was “reckless and irresponsible” as long as Chinese leaders continued to “block U.S. regulators” from viewing the company’s financial records. The U.S. Public Company Accounting Oversight Board (PCAOB), which generally audits firms before they are listed on U.S. markets, has long been blocked from auditing Chinese firms in the same way that they do U.S. companies. For a decade, the SEC has unsuccessfully attempted to obtain Chinese cooperation with the PCAOB. The issue has been a subject of recent U.S. legislation; in December 2020, President Trump signed the Holding Foreign Companies Accountable Act, which requires the SEC to delist publicly traded companies that are not overseen by the PCAOB. That law will affect Chinese companies that evade PCAOB oversight, but not until 2024.

Didi Global now faces two class-action lawsuits in the United States, which argue that the company failed to inform investors of Chinese regulators’ warnings to delay the IPO while they reviewed Didi’s cybersecurity practices. Didi did include Chinese regulation as a risk factor in its registration with the SEC. Two other U.S-listed companies—Full Truck Alliance (the “Uber for trucks”) and Boss Zhipin (owned by Kanzhun Ltd.), an online job recruiting platform—have also been placed under investigation for cybersecurity breaches by the Cybersecurity Administration of China. Both are now the targets of investigations and lawsuits in the United States.

All of this represents just the latest phase of Beijing’s crackdown on Chinese tech giants that have grown too powerful for the government’s liking. The clampdown arguably began in earnest in November 2020 after comments from Jack Ma, founder of Alibaba and Ant Group, were interpreted as criticism of the Chinese government’s approach to regulating big tech. Chinese regulators blocked Ant’s IPO, which had been slated to become the world’s largest, at a value of $37 billion. A series of measures targeting Ant—including a mandated transformation into a financial holding company, subjecting the corporation to more stringent regulation—have followed.

Ant still has not made its IPO. ByteDance, TikTok’s parent company, and Xiaohongshu, an e-commerce app, were both widely expected to go public, most likely including a U.S. listing, this year or next. Those plans may now be uncertain. LinkDoc Technology, a health care technology firm, and Ximalaya, a platform for audio sharing, have also reportedly delayed their U.S. IPOs. Chinese regulators are said to have pressured Ximalaya to drop its U.S. listing in favor of Hong Kong earlier this year.

Variable Interest Entities Under Fire

In another signal of the decoupling of the U.S. and Chinese stock markets, China’s State Council on July 6 directed the China Securities Regulatory Commission to examine closing a loophole that has allowed Chinese companies to circumvent limits on foreign investment. Large tech companies have long used the variable interest entity (VIE) structure to list on U.S. markets while evading Chinese regulations. Chinese regulators have not indicated that they will ban VIEs, but companies using VIEs to make foreign debuts now must seek prior approval from Chinese regulators. Additionally, firms that have already gone public abroad using the VIE structure will have to obtain approval from Chinese regulators before offering additional shares. The biggest fish in this category is Alibaba.

Using the VIE structure, Chinese-owned companies (like Didi) can establish a new shell company in an international tax haven, often the Cayman Islands. The shell company in the Cayman Islands is owned by the U.S.- or other foreign-based version of the Chinese company (Didi Global) that intends to have an IPO on a foreign exchange. The Chinese-owned company (Didi) then assigns control and profits to the Cayman Islands shell, giving the U.S.-based corporation (Didi Global) effective control over shares of the Chinese company (Didi), which it can then sell in foreign stock exchanges. The VIE structure has allowed Chinese companies to list abroad without enduring the prolonged regulatory process and “rigorous IPO vetting” that accompanies a listing in China’s domestic markets.

The present VIE rules have been in effect since 1994 and were first used by Chinese company Sina in its 2000 IPO. VIE structures have enabled massive foreign IPOs for Chinese tech giants like Alibaba, Tencent and ByteDance. Beijing hinted in December 2020 that it might end its practice of turning a blind eye to VIEs.

A recent study showed that Chinese VIEs in the Cayman Islands had a market capitalization of $1.7 trillion in 2017.

Other News

WeChat Censors Dozens of LGBTQ+ Accounts in China

WeChat deleted dozens of LGBTQ+ accounts in China on July 6 and 7, sparking vitriolic debate on Chinese social media amid fears of increasing crackdowns on queer content. Dozens of accounts, run mostly by university LGBTQ+ rights groups, were deleted in the latest wave of censorship. Account owners were locked out of their accounts after receiving a notification that they had violated community rules, without further detail.

Lists of the deleted accounts are circulating on Weibo, another Chinese social media platform. They include groups run by students at Tsinghua University in Beijing and Fudan University in Shanghai, two of China’s top universities. One of the groups had existed for six years and collected more than 18,000 followers before being deleted.

Homosexuality was decriminalized in China in 1997, but just this year a Chinese court found that homosexuality may still be described in a textbook as a mental disorder. LGBTQ+ individuals in China face widespread, overt discrimination, and there are few safe spaces for sexual and gender minorities. Some fear that official hostility toward LGBTQ+ communities is increasing. Shanghai Pride, which had been held for the past 11 years, was canceled without explanation in 2020.

Fudan University’s Shihe Society, one of the censored groups, issued a statement of resilience. The group said: “Our activities will not stop due to the closure. On the contrary, we hope to use this opportunity to start again with a continued focus on gender and society, and to embrace courage and love.”

U.S., China Observe 100th Anniversary of the CCP, 50th Anniversary of Kissinger’s Trip to China

July marks the 100th anniversary of the Chinese Communist Party (CCP) and the 50th anniversary of Henry Kissinger’s secret trip to Beijing, which marked the start of the opening of diplomatic relations between the United States and China.

Traditionalists greeted the anniversaries by condemning the apparent end of the “engagement” era inaugurated by Kissinger and President Nixon. The former secretary of state spoke at a virtual event with Chinese Vice President Wang Qishan, at which Kissinger urged a renewal of talks between the two sides, modeled after Nixon’s 1972 breakthrough visit with Mao Zedong. The feasibility of such a reprise is the centerpiece of the July issue of The Wire China; Orville Schell suggests that domestic politics would preclude it, while Katrina Northrop posits that tactical communication difficulties would pose additional obstacles. Meanwhile, President Biden and his advisers appear more aligned with the competitive paradigm associated with the Trump presidency.

American commentators focused on flashpoints of bilateral disagreement: Some argued that the celebration of China’s birth also marks the demise of free Hong Kong. Others took the opportunity to point out China’s nuclear buildup. Still others focused on the “increasingly authoritarian” tactics of the CCP.

Perhaps most salient was the discussion of Taiwan. (Incidentally, the island’s disputed status caused a kerfuffle last week, after the National Security Council tweeted a graphic that included the Taiwanese flag, a symbol of its sovereignty.) Kurt Campbell, coordinator for Indo-Pacific affairs on the National Security Council, warned China off its mounting aggressions toward Taiwan in a forum. Those comments followed Japan’s deputy prime minister’s remarks reiterating the importance of Taiwan to Japan and recalling his country’s willingness to use force to aid an ally.

Central to the foundation of the CCP was the question of national reunification. (At the time of the founding, China was splintered into feudal regimes; it was in part the Communists’ purported ability to unify the country that won them their initial influence.) Taiwan is the modern target of those ongoing ambitions. In President Xi Jinping’s address marking the 100th anniversary of the CCP, he remarked:

Resolving the Taiwan question and realizing China’s complete reunification is a historic mission and an unshakable commitment of the Communist Party of China. It is also a shared aspiration of all the sons and daughters of the Chinese nation. We will uphold the one-China principle and the 1992 Consensus, and advance peaceful national reunification. All of us, compatriots on both sides of the Taiwan Strait, must come together and move forward in unison. We must take resolute action to utterly defeat any attempt toward “Taiwan independence,” and work together to create a bright future for national rejuvenation. No one should underestimate the resolve, the will, and the ability of the Chinese people to defend their national sovereignty and territorial integrity.

Xi celebrated China’s “rejuvenation” with a warning to would-be foreign bullies: “Anyone who dares try [to bully, oppress or subjugate China] will have their heads bashed bloody on a Great Wall of steel forged by over 1.4 billion Chinese people.”


Yi-Ling Liu writes in Rest of World on Jack Ma’s failed attempt to create a “Harvard for China.”

Yinka Adegoke explores global attempts to copy the success of Alipay and WeChat’s role as super apps to the Chinese market, and why that’s so difficult to manage elsewhere.

The Wall Street Journal publishes an in-depth feature on Alibaba’s bid to rival Amazon as the world’s largest e-commerce giant.

For the Brookings Institution’s TechStream, David Bandurski considers whether the new “lying flat” movement among young, disillusioned Chinese could hinder the country’s push to be the global technological leader.

Steven Stashwick argues for Foreign Policy that continued U.S.-China competition can still lead to gains in the global push to slow climate change.

Yaya J. Fanusie writes for the Center for a New American Security on the global surveillance implications of China’s moves toward a unified digital currency.

Jeremy Goldkorn and Anthony Lawrence write for SupChina on the implications of the latest wave of U.S.-China financial decoupling.

David Morris assesses the possibility that China’s crackdown on Didi is motivated by a desire to “cater[] to the financial elite in Hong Kong” by increasing listings in domestic markets. Yvonne Lau addresses a similar argument in Fortune.

Including Didi’s latest losses, Chinese tech stocks have lost $837 billion in value since their peak in February. Analysts at Bloomberg and Yahoo! Finance discuss the causes and ramifications.

For Business Insider, Tasmin Lockwood and Shona Ghosh examine the decline in global venture capital flows into China since 2016.

Danielle Cave and Jacob Wallis write for the Australian Strategic Policy Institute on disinformation in democratic societies.

Chinese technology companies, led by ByteDance, appear to be retreating from the notorious “996” workweek (9 a.m. to 9 p.m., six days a week). Jane Li writes for Quartz on the ByteDance news.

Abby Lemert is a J.D. Candidate at Yale Law School, Class of 2023. She researches digital authoritarianism, surveillance technology, and international human rights and has worked for the U.S. State Department, the NSA’s Civil Liberties & Privacy Office, and Privacy International. She holds an M.Sc. in Informatics from the University of Edinburgh and an M.A. in Public Diplomacy & Global Communication from UCL, where she studied as a Marshall Scholar. She received her B.S.E. in Engineering and International Relations from Purdue University.
Eleanor Runde is a first-year student at Yale Law School and a member of the National Committee on U.S.-China Relations. Before law school, she worked on foreign policy and political history research for Kissinger Associates, Inc. She holds a bachelor's degree in Ethics, Politics & Economics from Yale College, where she focused on Chinese language studies and American political rhetoric.

Subscribe to Lawfare