Trump Moves to Ban Foreign Telecom Gear, Targeting Huawei and China
nytimes.com
nytimes.com
Which is a stronger argument, not weaker for suspicious treatment of Huawei by Western governments.
* devices on the gray market are very cheap, low barrier to entry for setting up a lab or a SMB infrastructure
* the lower end stuff is pretty much set and forget (e.g. we still have 1700 series devices from year 2003 routing calls without a hiccup)
* "nobody ever got fired for buying Cisco" company mentality
This executive order would forbid the government from purchasing and installing Telecom/Networking equipment that would be considered to have a higher than acceptable risk.
Given that China isn't exactly the most friendly nation to the US, and given Huawei is by nature, an extension of the Chinese Government, it's not unreasonable to assume China might at some point in the future (or already is) use Huawei to conduct electronic espionage against other nations.
Just like it wouldn't be unreasonable for China to forbid purchase and use of Cisco equipment within the Chinese government.
(We should also not forget or excuse Chinese IP theft which has enabled Huawei to produce competitive products in the first place...)
Banning corporations from doing that in their own commercial networks is another thing (and that is what happens now).
And pressuring other countries (either via ambassadors or other venues) and threatening with sanctions when they come to their own conclusions is yet another thing again.
I'd argue that it depends.
Many of the corporations that would run this type of equipment end up transmitting, storing, or using sensitive and/or secret information (ranging from corporate trade secrets/IP to classified information), or could be open to abuse in other meaningful ways (cell towers recording private phone calls from important people, etc). There's no real limit to the potential abuse.
We only have to look at what the US Govt has done already, and that's with a legal system designed to prevent such a thing, as well as needing voluntary cooperation from independent private companies. Change all that to largely nationalized companies and a legal system which doesn't care... and you can see where it can go.
Now of course we all know that the crypto at least in GSM was horribly weak and optional, because that is the way the US and France liked it, whereas countries such as Germany wanted strong crypto, fearing surveillance by then-enemy Russia next door.
EDIT: Anyone know how that is going to be in 5G? I would be surprised if we get decent end to end encryption, but did they at least limit the number of network elements that can access the voice data?
I'd consider blocking foreign products that might be insecure if they'd:
(a) Let me buy their secure products for same use cases. The WAN encryptors and Inline, Media Encryptors w/ trusted paths come to mind.
(b) Start recommending, sponsering, and evaluating more high-security systems like they did under TCSEC. Especially covering the costs of the platform with open, permissively-licensed code so others have fewer excuses not to build on it.
China has openly touted that their intention is global dominance (in all regards, including military, economic and technology). They haven't been shy about it for a long time. Given their economic and military scale today, you have to take that very seriously.
The US spends anywhere from 100% to 150% more on its military than what China does. That's mostly a difference in salary expenses in the US vs China. In properly adjusted terms, China is already matching or exceeding the US on military spending right now.[1] What will it look like when their economy is another 50% larger? How are the smaller, weaker nations in Asia going to deal with China if they're already annexing territory the size of France in the region? And then, in theory at least, their military is going to get drastically stronger.
A large amount of future global economic expansion will occur in Asia. So when you combine those two points, again, you have to treat the rise of China as a very serious matter for economic and military security if you're a superpower with outsized global interests as in the case of the US. That also goes for countries all over the globe that deal with China locally, and especially in Asia. Two of the best and most prosperous US allies are Japan and South Korea, who are also two of the world's largest economies. The US has an enormous vested interest in their well-being.
It makes no sense - no matter what you believe about the US or China - to pretend that the US should just treat China like they're another random smaller nation of no concern or special consideration. The exact opposite is the case. The US and China are going to compete at most things and it will split the world in half.
[1] https://www.bloomberg.com/opinion/articles/2018-05-25/china-...
In terms of total capacity, China has about ⅛ of the world semiconductor capacity, the fifth largest country... behind Taiwan, South Korea, Japan, and the US.
Couldn't agree more.
So, now we must go through a painful period while we atone for past mistakes... and hopefully learn enough to not repeat them in the future.
One must hope the population has the ability to stomach temporary losses for future gains.
If you have a good reason to suspect that state-level attackers could be in your supply chain, that reason doesn't go away just because the semiconductors were actually manufactured in Taiwan. Do we imagine that China's spooks don't have access to Taiwan fabs? Do we imagine that USA's spooks don't? If this is an actual threat to you, you need a lot more assurance than a "Made in Taiwan" label.
I certainly can, because it would be hypocritical to be against Microsoft using IP rights as a bludgeon on Linux, Qualcomm on Apple, Oracle on Google, and then be upset with Huawei on anything but stealing trade secrets.
Patents have not helped the common man for at least a hundred years as companies have paid for dubious patents to bludgeon smaller competitors with. Copyrights have strangled the arts since Steamboat Willie and have prevented the public from deciding what stories they want to share.
Trademarks and Trade Secrets, however, seem mostly fine, as knowing the real origin of a product is a greater good for the public than letting copycats grift them, and being clever doing something should be rewarded but once it can be replicated, the competition heats up and again helps the general public with better quality goods and services.
There is a difference between developing technology and getting into a patent war vs wholesale copying of a product so completely that you actually duplicate the BUGS.
Yeah, Huawei did that and Cisco, rightfully, went after them and won. Of course, it didn't do a lot of good after the fact.
This was so identical that you could type syntactically incorrect commands and get buggy, broken behavior which pinpointed the exact internal release of code which had been stolen as Cisco had already fixed the bugs.
Sorry, that's theft, even if you disagree with IP protection.
Or the guy who invented the aero press?
Or that time sears ripped off an inventor - and patents ensured they had to pay? [1] Or that other time when they misrepresented the value of a patent [2] - in that case the absence of the patent would mean there was nothing to have stolen.
Seriously, patents only really became terrible in the late 80s and 90s when the US gov. started allowing patents on what were functionally just concepts rather than actual inventions saying how something worked, and allowing patents on obvious uses of computers by virtue of "on a computer".
Patents on mechanical inventions are literally the only way for the "common man" to be able to make money off an invention. Without the patent rights:
* you have to be able to raise the capital to produce the device (corporations and the already rich have that - amazon was kept afloat solely because Bezos was already a billionaire).
* You have to price your device to pay off the capital expenditure, in addition to all the other costs
* You have to do that while also undercutting businesses that already have the manufacturing capacity to replicate your invention.
In the absence of patent protection on your invention you have little likelihood of recovering your investment as an individual.
Think of it this way: copyright says that copying something without/in contravention of a license is not legal, and so you can be sued. That allows things like linux to succeed - you can't make a product that uses it without contributing back. Patents are the same thing for inventions - someone doesn't get to copy your work (the act and work of inventing) without your consent.
[1] https://thehustle.co/sears-patent-infringement
[2] https://www.washingtonpost.com/archive/business/1989/09/18/s...
Note also that I don't trust the motives of Cisco, either, except to try to maximize their bottom line. (I'm not really worried about rouge employees at Cisco.) I think in service of said bottom line, Cisco and other companies will do almost anything. I'm not say all will do anything, just that some will, and when some will, there is a threat from them, too. Just like Cisco not giving a crap about security when it conflicts with them making more money.
The reality is that both just liked screwed up.
I suspect that the top telecom tech companies would go along with this idea, to get vetted, if it would help increase their business. Right now there are two European and one Chinese company who can ship 5G gear. I would like all 5G, and older gear also, to be vetted by international security labs.
Fixed.
https://www.tomshardware.com/news/cisco-backdoor-hardcoded-a...
Honestly you could probably do it without engineers knowing about it simply by cutting QA and red team budgets.
I'm not saying I think that's what happens at Cisco. Having worked at large companies that actively try to ship secure products, and having observed (as a paying end user) the general terrible-ness of networking hardware, that it is more plausible that they're just not being careful - I want to say incompetent by that is likely unfair to the majority of engineers there.
Of course nothing says that various gov. agencies in many countries aren't auditing the equipment themselves and making use of flaws without publicizing them.
And then there's leaving in five separate root logins in just in the first half of 2018. Like, come on.
Given the lack of subtlety and the wide spread existence of these same exploits/backdoors/bugs indicates there's a level of care that is missing in engineering of these devices that makes it plausible that this is by ignorance rather than malice.
1. US administration may change and might outlaw whatever unholy thing CIA is doing today; 2. CIA does it at a smaller scale, seeding smaller companies;
So it's okay? Fascinating.
https://medium.com/insurge-intelligence/how-the-cia-made-goo...
The fact is the majority of Telecom gear is foreign-made with regards to the US. To wit:
Alcatel-Lucent - France
Nokia - Finland
Siemens - Germany
Samsung - Korea
Fujitsu and NEC - Japan
If the US were to truly enforce a domestic US-only vendor selection it would be limited to Cienna, Cisco, Qualcomm and Motorola. And to my knowledge none of those four companies are making 5G switching gear.
So, Trump gonna require all potentially-subversive, foreign, R&D centers to be shut down with it all imported to America? Then require them to be US citizens born here with low risk of foreign influence? And then paid well with stable lifestyle with lower odds of bribery or blackmail?
I think he has no idea what it takes to reduce foreign risk. Besides, the so-called APT's are doing a number on our Fortune 500 companies with techniques like spear fishing with PDF-looking executables. I mean, how much will blocking Chinese equipment even help such companies? ;)
China especially has been playing the ultra-long game by slowly getting more and more countries under their dependence, buying up assets left and right and where that didn't help resorting to industrial espionage.
The problem that the telco operators have is that there is (thanks to Chinese dumping, did I mention they are playing a long game) next to no viable competition in either the US or the expanded NATO space - Europe has Ericsson and Nokia which are expensive and the US has Cisco which is expensive and crops up with at least one real backdoor a month.
From my experience in the industry, most of the protections being offered are hand-wavy things, like a software patch from Huawei being scanned by a desktop virus scanner for viruses or remote access gateways that record the screens of external employees accessing equipment where the demo I got for the solution the security prime couldn't figure out how to actually view the screen recordings. Huawei employees weren't allowed to give us any USB devices either. (I didn't work with Huawei routinely, although I know many who do. I tended to work with Cisco, Nokia, and several smaller vendors).
The only model I could see sort of working is forcing them to hand over the sources to an industry group or government entity, that is then responsible for auditing, building, and signing the software. But there are so many moving components slipping something past that is still plausible, and many barriers towards that sort of model.
You can argue the West doesn't behave as well as it should on the world stage, but Western ideology seems to be the best hope we have for an eventual egalitarian future, although the human cost will still be high. The further we get from authoritarianism, be it left or right, the better, in my opinion.
When it comes to China and Russia, what they are doing is a plan of the sort that can only be done in an authoritarian, controlled state.
I don't want him to do this. I don't want these tariffs.
Does this mean the Republican Party is compliant in this nonsense?
No they don't.
Most goods from China can be sourced elsewhere, moreover, America has the surpluses to handle some extra cost.
China doesn't. They are at the end of their last boom, and in trouble, it's really bad, and this comes at a bad time.
This is why China's response to Trump's most recent massive tariffs are much smaller.
The US has the upper hand in this, though not blatantly.
The sticking point right now is verification: both sides agree that China should stop with the IP theft, but the US does not believe China will actually do anything after the agreement has been signed, and so wants China to change it's laws. China sees this as a breach of sovereignty. So there's a huge face saving problem on China side, and to some extent on the US side with Trump.
I think they will work it out actually, a deal will be signed, China will take 'some steps' but they won't really care, Trump will be gone in a few years. I don't think that much will change in the end.
But these tariffs are really bad for China.
https://www.cbsnews.com/news/china-makes-8-46-from-an-iphone...
Are you sure you aren't misunderstanding the situation?
Trump is betting that low interest rates will prop up the US economy through the next election cycle. China is betting they won’t. The GOP is betting they can get Trump to “own” any economic fall out from the trade war.
(Edit: and you can stop him by voting)
Because of China, Taiwan is barred from attending WHO.
But I have been having more and more doubts when it comes to China. Free trade has not made China a more free place. It looks like they are just using their economic power to hurt freedom everywhere.
In one, international trading has built a web of mutual dependencies between countries. When your economic well-being depends on another country, you're less likely to go to war with them. The more inter-dependencies exist, the less likely armed conflict becomes.
Countries outside the trading bloc are then suspect: they have nothing to lose in attacking. Attempts to bring outsiders into the bloc via trade agreements, development, loans, etc, are all really part of a defensive security strategy.
This is nothing new: rulers have been marrying their children to those of their enemies for the same reasons since forever.
The other point of view, which seems dominant within the current US administration, looks at the inter-dependencies of international trade purely as a liability.
When the US relies on China to provide it with lots of manufactured goods, that is seen mostly (or solely) as a risk for the US, not as a stabilizing link in a web of mutual dependency.
Which is not to say that China (for example) won't try to leverage those dependencies to improve its position, nor to say that the US shouldn't encourage more widespread dependencies so that there's resilience in the system to bad acting on the part of any single player.
The point being that detaching from the web of mutual dependency makes you both weaker (in that you can only rely on yourself), and more threatening (since you no longer have anything to lose by attacking).
The US, by virtue of its size, can probably most afford to be isolated, but it's not clear to me that it's a good long-term strategy.
- China has engaged in state-sponsored corporate and military espionage; and
- Chinese companies are not separate from the state.
The only reasonable conclusion here is that Huawei gear on key networking infrastructure represents a security threat and really that's all there is to it. I find it odd that it's taken Trump, who otherwise is a disaster on pretty much every front, to actually say what is otherwise obvious.
[1]: https://www.penny-arcade.com/patv/episode/the-racist-clock-4...
Granted, he hasn't burned a cross on the White House lawn, but it's difficult to look at his statements and the unprecedented (and well documented) support his campaign had from racists and not conclude he probably is racist beyond a reasonable doubt.
[0]https://www.theatlantic.com/magazine/archive/2019/06/trump-r...
[1]https://en.wikipedia.org/wiki/Racial_views_of_Donald_Trump
As to "mountains of evidence", up until you've read the article I linked, you thought there was "mountain of evidence" about Charlottesville, too. Heck, you probably still think that, this particular bit of fake news has been drilled into everyone's skulls relentlessly for over a year.
What makes you think that other "evidence" is not of the same quality?
Today, the two are at opposite ends of the political spectrum. In
the interview last December, Trump said on Fox that Sharpton “is
a guy who I don’t believe really believes what he’s saying.”
And Sharpton has used his MSNBC and radio shows to criticize Trump,
arguing that his stances on Barack Obama’s birth certificate
and the Central Park Five were racist.
So that leaves the fact that he one dated a black woman as your evidence to disprove everything else?
H.P. Lovecraft was a racist and virulent antisemite, and yet he still married a Jewish woman. Racists are not racist about everything, all the time, like cartoon characters, and where people like Trump are concerned, obviously class status also has an effect on the way race is viewed.
Not terribly convincing.
[0]https://www.nationalreview.com/2015/09/trumps-pal-al-sharpto...
[1]https://www.huffpost.com/entry/al-sharpton-donald-trump-raci...
>Heck, you probably still think that, this particular bit of fake news has been drilled into everyone's skulls relentlessly for over a year.
Now you're resorting to personal attacks, so this conversation is over.
But Trump is the dude literally _nobody_ had any problems with until he ran against HRC, including the likes of Al Sharpton, Jesse Jackson, etc. He received the Rosa Parks award fer chrissakes: https://www.snopes.com/fact-check/trump-received-ellis-islan...
He had a black girlfriend, his son-in-law is Jewish. I really don't see how he can be racist. I think people may mistake his abrasive personality for racism, but when you're targeting individuals and not a race, it's not racism.
I did say it was circumstantial evidence, but there is a lot of it.
>He had a black girlfriend, his son-in-law is Jewish. I really don't see how he can be racist.
As I mentioned elsewhere, H.P. Lovecraft was anti-semitic, and married a Jewish woman. Also, Dick Cheney's daughter is gay, but he doesn't support gay rights (and yes, "gay" is not a race, let's not get bogged down in pedantry.)
It is entirely possible to be a racist and not perfectly consistent with one's racism, and to be racist against certain people or groups based on the admixture of race and class, or race and personal relationships. Racism is emotional, not rational.
The best you can say is that there's evidence for and against, but that still leaves evidence for.
I'll tell you more, Obama was against gay marriage well after that, as well: https://www.youtube.com/watch?v=N6K9dS9wl7U
Specifically, written of Cheney in 2004:
"Vice President Dick Cheney, whose daughter Mary is a lesbian, distanced himself from President Bush’s call for a constitutional amendment to ban same-sex marriage “Lynne and I have a gay daughter, so it’s an issue our family is very familiar with,” Cheney told an audience that included his daughter. “With the respect to the question of relationships, my general view is freedom means freedom for everyone. People ought to be free to enter into any kind of relationship they want to. “The question that comes up with the issue of marriage is what kind of official sanction or approval is going to be granted by government? Historically, that’s been a relationship that has been handled by the states. The states have made that fundamental decision of what constitutes a marriage,” he said."
Source: http://www.nbcnews.com/id/5817720/ns/politics/t/cheney-odds-...
Which is basically a position identical to Obama's position in 2008. Funny between two people holding the same views one is called a "homophobe", and another is a paragon of virtue.
I'm willing to be swayed if you can find a strong enough argument.