Gathering Quantitative Data in Mainland China
A locked door?
To many risk analysts, performing a quantitative security risk analysis for threat scenarios in Mainland China feels like trying to open a locked door.
Analysts Challenges:
Macro data such as crime rate, natural disaster, or fraud are usually not available at the public domain.
Authorities' websites are sometimes in the Chinese language only and often functioned as propaganda.
Information availability may not be geographically consistent. For example, crime data available in one province does not mean the same data is available in other provinces.
Authorities are often unresponsive to request for data. Words such as "security", "audit" and "investigate" are best avoided if one wants to increase the chance of response. Instead of the mentioned words, try "research", "understanding", or "study".
The source of information sometimes are not intuitive. For example, aviation related data are not held by the civil aviation department but are held by each local municipalities.
Public security (e.g. police) data are not transparent.
When data do show on the public domain, data may or may not be released regularly on a yearly basis.
Mitigating Techniques:
Talk to local acquaintances that are familiar with the matter (e.g.: supply chain theft or IT security breaches) that could help you to narrow down the analysis focus. However, not all have this luxury.
Look for year books that provinces or municipalities issue. Within those publication, there are sometimes sections that have statistics useful for security related analysis.
Look for research paper released by local universities.
Look for court verdicts. Unlike public security, court verdicts are transparent. This can be a proxy of estimating certain incidents growth or decline.
Baidu, as believed by many, is the most useful search engine for mainland China research.
There are websites that provide quantitative data based on voluntary peer input (think wikipedia), but the result may not be reliable especially when the number of input is low.
Ride on other analysts report for your own analysis. Be sure to seek permission if needed and give credit to the creator.
Look for reports released by local associations related to your research topic.
There are websites that provide quantitative data based on a combination of the techniques mentioned above. However, these usually require a paid subscription service.
Technique Caveats:
Information coming from Chinese sources have a tendency to show more positive information. When negativities do show, they often lack details.
Many of the above techniques mentioned require the reading of simplified Chinese.
Bottom line:
It is challenging to perform a quantitative risk assessment in Mainland China. However, it is doable if one attacks the problem from multiple angles.
When there are no hard data available, one can rely on multiple proxies or extrapolate from historical data in order to produce a reasonable risk assessment.
Be sure to show the methodologies and be transparent on any caveats, so analysts and client can enjoy a trusted relationship in the risk assessment effort.