On 4 September 2026 the IODA outage monitor flagged a critical-level connectivity disruption in China, with the alert naming Xizang (Tibet). The aggregator Voidly rated its corroboration as low, at 65% confidence, and attributed it to infrastructure failure rather than a government order. We found no official confirmation, no independent reporting and no new Chinese shutdown rule or order in the last 60 days. So this is not a story about a shutdown. It is a story about why nobody outside China's system could tell whether one happened.
What the law actually authorises
The strongest case for China's emergency power is that every state keeps one. Governments need a lawful way to cut or throttle communications during a mass-casualty event, a riot coordinated online, or an attack on critical systems, and it is better written down than improvised.
The amended Cybersecurity Law, adopted by the NPC Standing Committee on 28 October 2025 and in force from 1 January 2026, keeps that power. Article 60 of the amended text published by the CAC provides that, "for the needs of safeguarding national security and public order and handling major sudden social-security incidents", temporary measures such as restricting network communications may be taken in a specific area "upon decision or approval of the State Council". Lawfare's analysis of the law describes the provision as a continuation of long-standing authority to curb access for national security or social order.
The drafting history shows one real tightening. The July 2015 draft let the State Council, or a provincial-level government with State Council approval, impose restrictions in "certain areas". The current text routes the decision through the State Council itself. That is a narrower trigger on paper.
The weaknesses are the ones that matter for a Tibet alert. The statute has no duration limit, no requirement to publish the order, no notice to users and no independent review. "Major sudden social-security incident" is undefined. Under that wording a legal shutdown could take place with no public record of it.
What the incident-reporting rules do and do not cover
One might expect the CAC's incident-reporting regime to supply the missing transparency. It does not. The Measures on national cybersecurity incident reporting are 14 articles long and took effect on 1 November 2025. As Latham & Watkins summarises them, they sort incidents into four levels, from general to particularly major, and require operators to report "relatively major" or worse incidents to the provincial CAC within four hours. Latham notes the clock probably starts when the operator becomes aware of the incident.
The duty runs from operators to the regulator. It does not run from the regulator to the public. Latham's summary covers classification, timelines, report contents, vendor contracts and liability, and says nothing about shutdowns or emergency restrictions. A carrier whose Tibet backbone fails must tell the CAC within hours, but nothing obliges anyone to tell users, researchers or the press. Nor does the regime require the report to say whether the cause was a fibre cut, a power failure or an order under Article 60.
That ambiguity is structural. Under the same regime, a genuine fault and a State Council-approved restriction can produce identical records: an outage, a report to the regulator, and silence.
Why outside measurement struggles here
IODA infers outages from external signals such as routing announcements and active probing. Those signals show that connectivity dropped. They cannot show why. Region-level alerts in places with few operators, sparse international links and limited independent reporting are especially prone to false positives and to uncertainty about cause. Voidly's 65% rating and its infrastructure-failure attribution should be read as an honest statement of that uncertainty, not as a verdict either way.
The wider record is not reassuring. Access Now's KeepItOn report, released on 31 March 2026, counted at least 313 shutdowns in 52 countries in 2025, up from 304 in 2024, and named China among the countries where shutdowns were implemented. That justifies scrutiny. It does not justify treating any single unconfirmed alert as a shutdown.
A proportionate fix
We do not argue for abolishing emergency powers. We argue for the safeguards that make them accountable, and for care in how outside observers describe unconfirmed events.
- Publish orders. Any Article 60 measure should be announced with its area, legal basis and expected end date, as many democracies do for emergency decrees.
- Add sunset and review. "Temporary" should carry a fixed duration, renewable only by a further recorded decision.
- Record cause in reports. The CAC's incident reports should state whether an outage resulted from a fault, an attack or an official measure, and publish aggregate data on the split.
- Hold observers to the same standard. Monitors and journalists should label low-confidence alerts as such, as Voidly did, so a routing blip is not turned into a censorship claim.
The pro-innovation interest is plain. Businesses, from logistics firms to cloud providers and tourism operators, plan around network reliability. An emergency regime that cannot be told apart from ordinary failure raises the risk premium for every operator in the region. The 4 September alert remains unexplained, and the current framework gives no one outside the system a way to explain it.
The amended law also raised penalties. Per Greenberg Traurig, fines can now be imposed on first-time breaches, and regulators gained reach over foreign actors. That means operators are strongly incentivised to report incidents to the regulator, and nothing in the framework gives the public a matching right to know.