We have some action with the Chinese Police Security Bureau ("PSB") this month. You have probably heard of the PSB's crackdown on dissenters that led to arrests of unregistered house church members around Beijing over Easter. This increased activity by the PSB is not limited to Beijing but has also affected other areas of the country, even the partners we work with that primarily minister to Koreans in China.
One of our close partners is currently on the run from the PSB as they are trying to stop him from distributing the Bibles, media, books and aid that we provide to North Koreans, both in North Korea and China. As of this writing, he appears to be safe, but this raises some key operational questions:
- How do we protect our own networks when a partner is compromised?
- How do we protect our data that the partner has access to from China?
- How do we continue operations when one node of the network is cutoff by the PSB?
Here is how we answer those questions.
When a partner is compromised or on the run, we do our best to support that partner and reduce the risk to him and our network. However, our partners are aware of the possible consequences of the work they do. The possibility of arrests, time in prison, interrogations and general unpleasantness is part of the work and always has been (Acts 4, 1 Peter 2, Philippians 1).
For our data, as soon as we are aware that a potential partner might be compromised, we have protocols to limit their access to our systems and data. We have our reporting, document management and project management software designed to limit access to individuals by specific permissions in these systems. If we are worried that someone could be compromised, we can reduce their access and visibility into the system from any location where we can access a computer.
If we
know someone is compromised, we can immediately block that person out of the system so that their login information can no longer access the system. The key to making this work is designing and establishing the permissions and access from the beginning. Trying to sort out security parameters after-the-fact does not work. It will either reduce everyone's access or fail to secure the information well enough...or both.
Finally, we attempt to compartmentalize information as much as practicable while still enabling partners to communicate to get projects done. We have many partners in our networks working on projects without knowing, even in the same geographical area, other partners that are working with us. We work hard to keep information compartmentalized and avoid more convenient trips and visits when in China with some partners because of the risk partners may meet.
Of course, we also are aware that partners do contact each other and find out they are both working for us. So no one ends up feeling deceived, we communicate our protocols on compartmentalization and never imply to a partner that they are the exclusive distributor or user of a particular product. This is the way we attempt to balance security and operations, and stay a step ahead of the PSB.