← All talks

China's Unique Outsourcing System Explained #shorts

BSides Frankfurt3:3916 viewsPublished 2026-01Watch on YouTube ↗
About this talk
Discover how China's outsourcing system promotes state and civilian fusion for intelligence efforts. Article 7 creates a competitive environment for cybersecurity and IT companies. The ecosystem encourages innovation & autonomy. #bsidesfrankfurt #bsides #bsidesfra #AlixiaRutayisire #QuoIntelligence
Show transcript [en]

Ooh, let's see how the outsourcing system works. So, um the outsourcing system in China it's the result of really a comprehensive national uh strategy promoting the fusion of uh state and civilian um functions. So, um article seven of national of uh China national intelligence law that was passed in 2017, it obliged all individual and organization to support, assist, and cooperate with uh national intelligence efforts. So, for China, intelligence collection is not the domain of the state, it's the responsibility of the whole society. So, in practice, this has created a dense uh and highly competitive environment where you have uh dozens of uh cybersecurity or IT companies um that range from uh uh industry leaders to small and

mid-size enterprise that competes for uh contracts uh with uh intelligence agencies. And uh it's super common in this environment for some of the uh bigger uh companies to contract some smaller companies for some work. Uh so, yeah, the state contract a big company for uh cyber operation, and then this company delegates to a small company that will uh do um a niche part of the of the contract. And [snorts] uh so, you have layered of network of subscon uh subcontracts. Uh And um therefore, you have varying degree to uh of ties uh with the state. And um this ecosystem is really competitive. Uh and uh this foster innovation because uh each company try to uh come out of uh

these tenders and win contracts, and therefore they're really competitive. And they also uh win contracts in based of relationships uh that have uh been uh personal and institutional relis- uh relationship that are established. And uh specific uh aspects of this ecosystem compared to um the Russian one is the high degree of uh of autonomy. So, some of this company, they're launch their own uh cyber operation uh saying, "Okay, so maybe the state could be interested in this aspect, so I will myself launch uh cyber operation targeting um that type of entities, and then I will propose uh the information to the state." Sometimes the state is not interested, and sometimes it does. Uh so, they're

kind of trying to get the attention of the different um intelligence agency that way, and they're highly autonomous. And um yeah, once in this system, they can really conduct a full uh spectrum of uh operations.