China cyber-security law worries foreign firms