The debate over the security of Chinese technology is taking on a new dimension in Europe, with the Czech Republic's National Agency for Cybersecurity and Information Security (NUKIB) issuing a strict directive to critical infrastructure organizations. The agency explicitly calls for avoiding both the use of Chinese equipment and the storage or transfer of data on servers within China, stressing that such practices pose a significant threat to national cybersecurity.
From "moderate" to "high" risk level
NUKIB announced that it has revised its risk assessment related to Chinese activity, now placing it at the “High”. The reasoning behind the decision is clear: as critical infrastructure becomes increasingly dependent on cloud storage, network services and remote updates, the reliability of technology providers becomes a key security factor.
See also: A2: New AI tool for discovering & validating Android vulnerabilities
According to the announcement, "technology solution providers can substantially affect the operation of critical infrastructure or gain access to sensitive data," making trust in the supplier an absolute prerequisite for the security of the state and society.
China's shadowy presence in cyberspace
The Czech cybersecurity agency is not limited to theoretical scenarios. It has already identified cases of malicious activity originating from China, including a recent campaign by the APT31, which allegedly targeted the Czech Ministry of Foreign Affairs.
Furthermore, China’s legal framework allows the government to demand access to data stored on Chinese cloud providers. This means that any company hosting data on Chinese servers can, in effect, be forced to hand it over to the authorities. For the Czech Republic – and by extension every EU country – this poses a serious risk of sensitive information being leaked.
From networks to mobile phones and electric cars
The NUKIB directive is not limited to critical infrastructure. It also refers to consumer devices, from smartphones and IP cameras to electric cars, medical devices, photovoltaic inverters and large language models. All of these categories are classified as potentially dangerous, as they can act as a gateway for data transfer to China.
See also: Abusing iCloud Calendar to send phishing emails
The message is clear: the threat is not limited to military or government infrastructure but touches the daily lives of citizens. From health data to the movements of an electric vehicle, the range of information that can be collected is enormous.
What does the directive mean in practice?
Although NUKIB's warning is not a legally binding ban, it is of significant importance for organizations subject to the Czech Cybersecurity Act. These include sectors such as energy, transport, healthcare, public administration and financial services. These organizations are now required to include the Chinese threat in risk assessments and implement protective measures.
In practice, this could mean:
- Data transfer to European or domestic cloud providers.
- Gradual de-reliance on Chinese hardware and software.
- Establishing more stringent auditing procedures for technology suppliers.
Europe against Chinese technology
The Czech Republic's stance is not isolated. At the European level, there have been similar moves against Chinese technology giants such as Huawei and ZTE, which are considered a high risk for the security of 5G networks. The new NUKIB directive is part of this broader strategy to limit Chinese technological influence.
See also: Malicious npm packages mimic Flashbots & steal wallet keys
At the same time, this development also highlights the EU's effort to promote digital sovereignty , giving impetus to European cloud and infrastructure solutions.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
What does it mean for citizens?
While the document is not binding on the general public, the agency recommends that citizens study it carefully. The use of Chinese devices by individuals is not prohibited, but information about the potential risks is crucial. From smart security cameras to wearables and smart home devices, users are urged to weigh cost, functionality and privacy before making purchases.
The Czech Cybersecurity Agency's decision to raise the Chinese threat level to "high" reflects a broader concern in the West about its dependence on Chinese technology. The discussion concerns not only states but also citizens themselves, who use devices that collect and transmit data every day.
As technology becomes increasingly interconnected, choosing suppliers is no longer simply a matter of cost or quality; it is also a matter of national and personal security. Time will tell whether other European countries will follow the Czech Republic's example by erecting firewalls around their critical infrastructure.
Source: www.bleepingcomputer.com
