<\/p>\n
Across Southeast Asia, Chinese firms have laid fiber-optic cable, built smart-city platforms, supplied 5G networks, and even donated laptops to defense ministries. By one common account in Washington, this is what losing looks like: through its Digital Silk Road, Beijing is exporting not just technology but authoritarianism itself.<\/span><\/p>\n But ask the officials who actually regulate these systems what rules they follow, and a more complicated picture emerges. Indonesia\u2019s cybersecurity agencies enforce technical standards developed in Geneva. The Philippines modeled its data privacy law on European regulation. Malaysia\u2019s approach to artificial intelligence borrows from U.N. principles and regional frameworks. In three of the Digital Silk Road\u2019s most important partner countries, Chinese hardware is widespread but Chinese rules are not.<\/span><\/p>\n China may be winning many of the contracts to build out Southeast Asia\u2019s digital infrastructure, but Beijing is making less headway on the rules. Understanding this \u2013 and the factors behind this reality \u2013 complicates the prevailing concern about digital authoritarianism. However, there is one scenario in which the hand-wringing about digital authoritarianism could become a self-fulfilling prophecy.<\/span><\/p>\n China\u2019s Digital Silk Road<\/b><\/p>\n China\u2019s Digital Silk Road (DSR), the technological arm of the Belt and Road Initiative (BRI), has spread Chinese-built networks, surveillance systems, and cloud infrastructure across the developing world. Embedded in that infrastructure, many argue, is a political model: \u201ccyber sovereignty,\u201d centralized data control, and a state\u2019s right to intervene in its digital sphere as it sees fit. Analysts have warned that the world could fragment into <\/span>technological spheres of influence<\/span><\/a>, and Southeast Asia \u2013 a region that is young, rapidly digitalizing, and ambivalent about democracy \u2013 is seen as fertile soil for <\/span>Beijing\u2019s model<\/span><\/a>.<\/span><\/p>\n These concerns are legitimate and deserve to be taken seriously. <\/span>As I <\/span>wrote last year<\/span><\/a>, the DSR aims to export both China\u2019s technology and its preferred norms, in a bid to set the rules of digital governance rather than simply build the infrastructure. Beijing\u2019s own Chinese-language framing of the initiative leaves little doubt about that ambition. But whether those norms actually take root is a separate question.<\/span><\/p>\n Minxin Pei argued in his book \u201c<\/span>The Sentinel State<\/span><\/a>\u201d that China cannot export its surveillance model at all. According to Pei, the technology is only part of China\u2019s digital authoritarianism; what matters most is the human infrastructure that can mobilize millions of citizen informants against anyone suspected of disloyalty. China\u2019s Leninist police and internal-security bureaucracy reaches into workplaces, campuses, villages, and neighborhood committees. Cameras and facial recognition software has supercharged this apparatus, but technology by itself can\u2019t replicate China\u2019s security state. One may infer from this that a foreign government that buys the hardware without the Leninist bureaucracy essentially inherits a shell.<\/span><\/p>\n Pei is right, and his argument is a necessary corrective to much of the hype around exporting digital authoritarianism. But what do host countries\u2019 governments actually want from Chinese technology? What do they do with it once it is installed, and whose rules do they write around it?<\/span><\/p>\n Over the past several years, a <\/span>research project<\/span><\/a> I lead at the Peace Research Institute Oslo (PRIO) has put these questions to the test. I conducted over a hundred interviews with government officials, regulators, technologists, industry figures, and civil society actors in Indonesia, Malaysia, and the Philippines \u2013 three of the Digital Silk Road\u2019s flagship partners \u2013 alongside systematic analysis of official documents and speeches.\u00a0<\/span><\/p>\n Some of my findings were <\/span>recently published<\/span><\/a> in the Review of International Studies<\/span>. To summarize, Southeast Asian governments are not adopting China\u2019s digital governance model together with the technology, at least not yet. Neither are they rejecting it in favor of the West\u2019s model. Rather, they are picking and choosing, taking Beijing\u2019s hardware while writing their own rulebooks, drawing from European regulation, U.N. norms, regional frameworks, and their own political traditions.\u00a0<\/span><\/p>\n Locked Out of Cybersecurity?<\/b><\/p>\n Consider the domain where Chinese influence should be quite strong: cybersecurity. Here, Chinese norms are essentially absent.<\/span><\/p>\n In Indonesia, the national cyber agency, BSSN, anchors its guidance in ISO 27001, the international standard for information security management. Banks follow central bank regulations; fintech firms answer to the financial services authority; and all of it, as one member of the country\u2019s cybersecurity community described it, aligns ultimately with international standards. Indonesian officials talk a great deal about digital sovereignty, but the rules their institutions actually enforce were mostly written in Geneva and Washington.\u00a0<\/span><\/p>\n Similarly, Malaysia\u2019s cybersecurity governance took shape in response to U.N. processes, and Kuala Lumpur has endorsed U.N. norms of responsible state behavior in cyberspace. Its capacity-building partners are Canadian firms and EU programs. The Philippines aligns even more explicitly with the West: its Data Privacy Act was consciously built on the European GDPR model, and officials describe international cybersecurity governance as a Western-dominated affair.<\/span><\/p>\n Thus, in cybersecurity, it seems that balance was struck long ago in favor of the incumbent powers rather than Beijing. Technical standards have enormous inertia. Once a country\u2019s banks, telecoms, and certification regimes run on ISO and Western frameworks, the switching costs are prohibitive, and every new regulation layers on top of the old ones. And Beijing arrived to the standards race decades late.\u00a0<\/span><\/p>\n On top of this, there is widespread official mistrust of Chinese platforms. Such sentiments were voiced repeatedly in interviews, even by officials in governments happy to accept Chinese infrastructure.<\/span><\/p>\n Pei argued convincingly that officials abroad could never replicate the Chinese party apparatus. But my research found that nobody in the governments of Indonesia, Malaysia, and the Philippines seemed to be looking to Beijing for rules in the first place \u2013 even in areas where Chinese technology is most deeply embedded. Recipient states have their own institutions, values, and strategic calculations, which they seek to pursue while using Chinese technology.<\/span><\/p>\n The Opening in AI Governance<\/b><\/p>\n Unlike cybersecurity, however, the ethics and governance of artificial intelligence represent new terrain. There is as yet no entrenched standards regime for these technologies. If Chinese norms were going to take root anywhere, it would be here. What is emerging instead is a blend of norms.<\/span><\/p>\n This is in spite of China\u2019s obvious efforts to promote its own model. I recent years, Beijing has issued a steady run of normative offers aimed squarely at this space, including a Global Initiative on Data Security in 2020, a Global AI Governance Initiative in 2023, a Global Governance Initiative unveiled at the Shanghai Cooperation Organization summit in Tianjin in September 2025, and most recently the World Artificial Intelligence Cooperation Organization <\/span>established in July 2026<\/span><\/a>. As Henry Tugendhat <\/span>observed<\/span><\/a>, despite this succession of declarations, their actual impact is hard to define, let alone measure.\u00a0<\/span><\/p>\n My fieldwork in Southeast Asia suggests one reason why we\u2019re not seeing China\u2019s efforts pay off: No one is actually referencing these initiatives when drafting regulations or statues within the region\u2019s governments.\u00a0<\/span><\/p>\n In Indonesia, officials frame digital ethics through Pancasila, the state\u2019s founding philosophy, insisting that the country\u2019s digital life must reflect national values rather than any imported template. Nonetheless, these same officials describe an ambition to shape global norms, by participating in international forums and pushing for frameworks that fit Indonesia\u2019s circumstances. There\u2019s little interest in simply adopting a foreign approach to AI governance \u2013 from China or elsewhere.\u00a0<\/span><\/p>\n Malaysia\u2019s approach is more openly pragmatic. Analysts there acknowledge that the country lacks an indigenous framework for regulating AI. Instead, policymakers study foreign examples, then match these approaches to the domestic market. The biggest policy debate in Kuala Lumpur is whether to absorb Europe\u2019s data protection regulation wholesale, as the price of trading with Europe, or to write a separate privacy law for Malaysian consumption. Either way, the reference points are European and multilateral. China\u2019s preferred models barely feature in the discussion.<\/span><\/p>\n For its part, the Philippines\u2019 national AI strategy addresses fairness and bias; agencies across government worry about the ethical deployment of automated systems. On the ground, Filipino data scientists describe retraining imported AI models because they produce skewed results when applied to Philippine data. Foreign technology and its embedded assumptions are conscientiously recalibrated to fit local realities.<\/span><\/p>\n Hovering over all three countries is ASEAN. Its regional guides on AI governance and data \u2013 documents that are largely ignored outside the region \u2013 function as templates through which Southeast Asian governments mediate between external models and domestic priorities. Regional multilateralism, so often dismissed as talk, acts as a filtration system.<\/span><\/p>\n In cybersecurity, where the rules were settled long ago, the West\u2019s standards won by default and China is locked out. And in the field of AI, where the rules are still being written, Southeast Asia is drawing overwhelmingly on Western and multilateral sources, adapted through local values and institutions. China\u2019s normative model isn\u2019t winning converts in either case.<\/span><\/p>\n Fighting Standards With Standards<\/b><\/p>\n It would be a mistake to read these findings as grounds for complacency, though. The strongest predictor of whether a state filters foreign norms rather than absorbing them wholesale, <\/span>our <\/span>new research<\/span><\/a> suggests<\/span>, is institutional and regulatory capacity, the strength of civil society, and the specific ways the technology is adopted. Likewise, states have more scope to exercise their digital autonomy when great powers compete for alignment.\u00a0<\/span><\/p>\n Today, Southeast Asia mixes and matches technology regulations. But in a world of Western retrenchment, China would be the single full-service provider of infrastructure, financing, and governance templates. The outcomes would tilt toward Beijing \u2013 less because Chinese norms had become more persuasive than because the available options had shrunk.<\/span><\/p>\n This is already happening, as evidenced in Washington\u2019s own documents. The National Security Strategy (NSS) released last year barely mentions Southeast Asia. Where the region did figure in the NSS, as Derek Grossman <\/span>argued<\/span><\/a>, it was as a vehicle for American economic objectives rather than a strategic partner in its own right. When the Trump administration launched Pax Silica, its initiative to secure semiconductor and critical mineral supply chains, the only Southeast Asian country initially named as a key partner was Singapore. (The Philippines eventually joined in April 2026).\u00a0<\/span><\/p>\n Meanwhile, Chinese officials and firms adjust their pitch over time, tailoring normative messaging to local elites. Huawei\u2019s <\/span>training programs<\/span><\/a> across Southeast Asia are building relationships with the next generation of engineers and regulators. The adoption of Western-leaning cybersecurity norms might be immovable at this point, but the region\u2019s eventual stance on AI governance is still in flux \u2013 and that gives China an opportunity.<\/span><\/p>\n