China’s new cyber-security law is worryingly vague