Huawei’s Ace in the Hole: Undersea Cables | Hacker News Reader

Huawei’s Ace in the Hole: Undersea Cables

asia.nikkei.com

214 pointsmlacks176 comments

> Specifically, on top of Japan, the U.S. and Australia, cables connected to NATO members should be off-limits to Huawei.

I don't understand this at all... if the communications across the cable are properly secured then it shouldn't matter what cables it runs across.

These aren't military links. Lots of stuff is unencrypted or shittily so.

Surely a few potential snooping countries have the capabilities to tap seabed fibre by now, and we'd be better served having carriers add encryption at the link level regardless of who laid the cable.

The carriers would get subpoena/NSL'd in a heartbeat

Huh? Are you kidding? Each cable bundle can transmit petabytes of data per second. Think of all the Netflix movies being watched in Japan and Australia transmitted over that cable. Why would anyone encrypt that? Furthermore, the hardware required to encrypt, even if feasible (and that’s unclear), would be astronomical in cost.

Plus, it’s not just about access. A malicious actor could always damage or destroy the cable, cutting off a primary channel of communications.

"Encryption is so expensive!" cries the 1990s

That's a lousy example because Netflix movies are definitely encrypted.

They're also almost always served via a local CDN node. A million Australians watching the latest Game of Thrones episodes probably means a couple dozen transfers of that file across the Pacific, not a million.

If you're an ISP, Netflix will even send you (free!) servers for this. https://openconnect.netflix.com/en/

> If you're an ISP, Netflix will even send you (free!) servers for this.

  startyourownisp.com

I think this might be a bit much for getting some freebies. It would be fun, though. Unfortunately, it would take me a lot of work in the place I'm at for this to make any sense at all.

You’d have to prove that it’d be beneficial bandwidth wise, which seems unlikely.

Setting up an asymmetrical encryption channel can be hard (and expensive). But once it's set up it moves to a cheaper faster symmetrical encryption which rotates the keys. There are dedicated chips for this encryption that it barely takes any processing power at all.

Also note that would be the backbone encryption channels, but inside those people would be using https which is encryption further up the networking stack.

It's encrypted turtles all the way down.

The concern is less about traffic interception and more about being able to sever / significantly undermine a country's ability to communicate during, for instance, time of war. This is also largely where the 5G infra concerns come from.

The internet was literally designed to solve this problem.

yes, but doesn't as it is used nowadays.

Few and big backbones are responsable for almost all traffic. Few and big CDNs serving most of the contents that are used by everybody. Even few apps are "essential" for daily life.

Big money was/is created when internet become business as usual: few and big corps taking the biggest share.

Big backbones are only needed for commercial traffic, like Netflix. If it comes to war, I think the first thing US government will do is it will force all ISPs to cut off private network connections in order to 1) save the bandwith 2) stop spreading of inconvenient news.

> if the communications across the cable are properly secured

I think the history of human communications is an ample demonstration of why this is a poor assumption.

Are you thinking of encryption or something? Because that doesn't prevent an eavesdropper knowing how much data was transferred, to and from whom, and when. That could all be sensitive information.

The Five Eyes governments have access to Layer 2 and 3 encryptors for site-to-site protection rated by their security services to be way more secure than most stuff out there. They also have ability to do constant transmission of packets to hide metadata. Only Defense organizations are allowed to buy them. They can buy and deploy them if concerned about untrusted intermediaries.

When they don't usually means something else is the problem.

> Only Defense organizations are allowed to buy them

Source? Encryption has not been treated as a munition by the United States since the 90s.

That's incorrect and a different issue. I'll address it, too, though. The first are systems made to NSA's Type 1 abd TEMPEST certifications. They have requirements for RNG's, assuring implementations, failing safe, side channel mitigation, etc. NSA puts them through rigorous pentesting. If NSA cant hack it, then it gets approved to protect Defense assets. There's strong controls on handling the hardware and key systems. Feel free to try to buy NSA's Inline Media Encryptor or General Dynamics Type 1 encryptors. They'll tell you that you can't buy it. Go try. Ask them for a HAIPE implementation while you're at it. I hope you prove me wrong.

Far as export, I looked into that in 2014. I found that only a few things, like mass market and ecommerce, got reclassified. High-assurance systems (EAL6/7) they couldnt hack were still munitions. So were custom crypto and some other things. People got fooled: NSA reclassified just the stuff they'd be able to hack anyway. Big progress but not what people thought.

https://www.schneier.com/blog/archives/2014/11/the_return_of...

They tried to pull more crap about a year after I wrote that:

https://www.computerworld.com/article/2925339/us-proposes-ti...

I don't know what current state of affairs is. I assume they've set it up where they can deny selectively if they feel the need to. So far, most "security" products are too insecure for them to need to do that.

The issue is probably availability. Assuming Huawei to be an adversary, if they have control of communications, they can decide to drop all packets (or slow or drop some, etc.). This would wreck plenty of havoc on communications.

It seems wise for the US to ensure that they control major backbones and don't become dependent on critical backbone links owned by (potential) adversaries.

Similarly, it's understandable that the Chinese want to start building their own backbone infrastructure so they're cannot be cut off from the world if they end up in a conflict with the U.S.. From that perspective, it makes sense that Huawei would start laying these cables. It can be seen as a defensive move.

I've long been wondering whether the Chinese have subverted IP infrastructure hardware, which is all produced in China, often by Chinese companies like TP-Link. How much of that stuff has a kill switch in it that they can activate if a conflict with the West breaks out?

I'm kind of skeptical that there's a real risk here too... seems like a simple enough matter to ensure stuff you're worried about security of stays on channels you control right? This doesn't seem like that big a challenge, it sounds like more of a defensive measure than a threat.

But if there is a kill switch in so many cheap devices then wouldn't someone would have found it by now? It's not like people aren't looking. It's not like these devices are super secure.

Perhaps the higher end, non-consumer facing, equipment might have it. But for the cheap tp-link devices I highly doubt it.

We still have no idea what the Intel ME microcode is, present on almost every pc manufactured. I think it is very possible, plausable, or even likely.

And also the the software that runs embedded in the mobile phone chips (not the phone, but the chips for stuff like GSM/3G etc). And that's why the fight for 5g is important.

All the more reason it's not in the cheap TP-Link routers but in the mobile phone chips which can't be examined so easily.

Why is that?

Won't 5G also have dedicated hardware?

There are multiple usable open-source LTE handset software implementations. They work with a suitable SDR like e.g. a LimeSDR or similar. AFAIK not even a single open-source UMTS software implementation works well enough for practical, day-to-day use. More than one of the LTE implementations archived that reliability. They all guzzle power though, IIRC. But that's the easy part (offload ping detection and FEC (de-)coding to an FPGA).

Are there opensource impl for LTE baseband for smartphones? Which ones? I've heard of OsmocomBB and it is 2G only, IIRC. https://osmocom.org/projects

https://github.com/srsLTE/srsLTE

Thanks. I've heard of srs before but failed to notice their ENB project.

> srsENB has been tested and validated with the following handsets:

    LG Nexus 5 and 4

    Motorola Moto G4 plus and G5

    Huawei P9/P9lite, P10/P10lite, P20/P20lite

    Huawei dongles: E3276 and E398

That's a very limited set of handsets. I wonder what's stopping them from adding support for more devices: Is it lack of contributors (no traction, lack of interest), or the cost of development (insanely difficult to reverse engineer, potential IP infringement etc), or limited and buggy functionality (doesn't work with certain carriers etc)?

But non of the actual mobile phones will use software over dedicated hardware, so I fail to see the relevance of dalore's comment: "And that's why the fight for 5g is important"

You usually have cores doing what the specs requires and then a processor running your software gluing it all together.

Mainly because implementing LTE is much easier then UMTS.

5G isn't even considered critical infrastructure, same goes for the predecessors. So I don't know why the fight is important.

How is not critical one might ask - the amount of battery time when power goes down. It's in range of minutes, sometimes there isn't even a UPS.

> But if there is a kill switch in so many cheap devices then wouldn't someone would have found it by now? It's not like people aren't looking. It's not like these devices are super secure.

Meltdown was only discovered last year, despite being a vulnerability in virtually all Intel CPUs made since 1995. I suspect there are substantially more eyeballs on Intel, too.

Try building Meltdown on purpose! Who will know? How do they defend design choices to those who can't know?

Nobody can afford this in breadth. Granted, you can manufacture a rigged batch and keep it secret. But you can't have a broad capability and expect it to remain secret for long.

So... US now wants network neutrality?

Yeowch.

I guess they consider their own country to just be a large intranet, and the internet- the web between countries, is the thing they want neutral? Politics is not fun to deal with.

It's networks all the way down

> The issue is probably availability

I imagine every undersea cable would be cut in the first week of a US-China conflict, regardless of who built it.

Well that's all good for the cables connecting USA and China but what about cables elsewhere? I guess in such a situation you wouldn't want you opponent to have control of critical infrastructure.

GP means that cables connecting enemy territories would be cut by submarines, not just that cables connecting warring parties would be cut at landfall.

or drop a PGM on the landing points / supporting infrastructure

Um...

I don't think you're thinking like a military person.

I mean, if it's total war? Well, sorry, but it's total war.

I wouldn't count on too many undersea cables not being cut.

I hope that countries have the protocols in place for prioritized satellite communication.

I imagine within hours of a total war, space will become a highly militarized battlefield with kinetic and laser weapons knocking just about everything down as fast as it is put up.

Telecom satellites would be getting shot down in the first week, too.

Elon's new constellation must be making for some fun plannig for those people. 60 new targets now, several hundred more new targets real soon now. I wonder if SpaceX and Blue Origin are launching payloads they're designed to shoot down their own payloads?

I assume sending up a comsat is more expensive than sending up explosive to destroy it.

Possibly. It's not like the military-industrial complex is known for it's cost-effective solutions though...

Given the manoeuvring requirements for the orbiting explosives, and the requirement to launch them with enough plausible deniability for it not to be obvious "there's a bunch of commercial satellite killers!" - I wonder if they could build and launch 60 of them for less than SpaceX paid to get the first 60 Starlink birds in orbit?

Actually I guess... it is sufficient to send up mines (lots of them) and wait for the satellites to hit them.

Nevertheless, this is such a terrible idea, I hope this is not the future.

Space (even low earth orbit) is BIG.

Very very big...

Yeah, but the satellites are not too maneuverable. The trajectory is mostly mechanical.

Which would prevent any chance of restoring them or any space travel at all for many generations until we work out how to clear out billions of bits of rubbish flying around faster than bullets.

I understand that the US/NOAA only grants satellite licenses if you agree to allow the US to preempt your use of the Satellite.

Total war means nukes. There will be sore losers.

If countries start firing nukes then I would be surprised if there were any winners.

Yes, the humans.

I'd have thought carbon based life in general might be worse off ...

We need less people thinking like military people in the world. Too many toy soldier fantasies result in leaders like George Bush jr fulfilling their fathers dreams.

Armchair soldiers who have watched to many movies, the world is full of them.

A China-US conflict means dozens of nuclear weapons dropped on populous cities across the world in a matter of hours.

How anyone seriously entertains this idea is unreal.

It seems to me that the US-China conflict has already started as a slow but expanding series of limited engagements. Today these are economic and "cyber". However even if such a conflict were to go kinetic, it would likely be in a more limited sense - most likely at sea.

An example of what limited conflict looks like is the Sino-Indian war which was kept confined to a limited geographic area. Its not a forgone conclusion that a conflict has to become "total".

  most likely at sea

There's no way a threat to navies won't quickly jump to very serious warfare, of a kind that breaks open to involve lots more than just limited seaborne engagements.

An oceanic conflict in the Pacific is going to ruin air traffic, and with both air and sea lanes compromised, you see the beginnings of blockades and economic business as usual encounters entanglements all over.

If big expensive ships start sinking, and the projection of air power changes, everything else heats up very quickly, because replacing military fleets (and the sailors to match) is a slow process, and any major setback could prove permanent and lasting.

Don't expect a naval limited war to stay limited for long.

The most likely scenario would be one “freedom of navigation” cruise too many. In which case it would be a small number of vessels. It’s in neither countries interest to have all out warfare so it seems unlikely the skirmish would extend past the vessels involved.

Confidentiality, integrity and availability. Those are the components of a secure system. Crypto provides the first two. But what about the third?

The third is a lot less important and doesn't call for the same approaches as the first two.

If availability is compromised, that is obvious to the end user(s).

It's still important. Otherwise you get statements like: "the most secure computer is one that isn't turned on" like that wouldn't be obvious.

That statement is correct, obviously, and its wisdom is actually implemented in things like network segmentation, air gaps, and cold wallets.

Availability is still important, but, as I said, much less important than integrity. (The importance of confidentiality varies.)

And having a problem you know about is pretty much always a significant upgrade compared to having a problem you don't know about.

None of them are less important. All three need to be present in order for a system to be secure.

Especially when it comes to attacking infrastructure, removing the availability of operations on this infrastructure is a good attack vector. This can be done by, for example, creating a temporary ban on logging in. It can be done by reporting a hacking attempt from the legitimate IP address range.

I'd assume that "properly secured" isn't meaningful for large state actors.

The US spent billions routing international telecom infrastructure through US and allied points of presence for a reason.

And they really dont want anyone using good end to end e encryption for the same reason ;-)

Remember "ssl added and removed here"? https://arstechnica.com/tech-policy/2013/10/new-docs-show-ns...

That cheeky smiley face gets me every time

Also how they quickly defined GFE to be Google Front End.

Not anymore though. Everything is encrypted now.

Everything escalates, including the NSA's capabilities...

DNS isn't. And BGP is utterly insecure.

DNS over https is becoming more common now firefox is using it.

Also, if you've got a ASUS router, check out Merlin (after market) firmware, which recently added support for DNS-over-TLS. It works quite well.

The point was about Google and their communication.

Yeah but this is different. The cost of adding e.g. MACsec on a long haul link is a rounding error compared to the costs of the link.

Right. And it doesn't matter if the burglars have keys to your house if they don't know the alarm code, right?

At a certain point you place trust in SSL certificate authorities. Couldn't a company that runs the infrastructure itself spoof IP addresses and man-in-the-middle everything?

What do you mean by that? Like a country redirects DNS resolution to their own controlled IP's and gets one of their CA's to issue duplicate certs? That could certainly happen and would be devastatingly effective until other people catch on.

Spoofing IP's alone isn't enough, but CA infrastructure is very much based on a trust that is weaker than we'd like to admit.

If it were properly encrypted it might be negitible. But DNS for instance still isn't. And the BGP is completly broken. There was a case recently where someone used BGP to redirect users of myetherwallet to steal their coins. They failed to obtain a SSL certificate so the users could have noticed. But with a more sufisticated attacker I think the average user has no chance to detect such an attack.

It's not just the cable plant but also the transport gear that are the add/drop points for their OSN/OTN. I feel like the article fails to expose this. When the first active element in an optical network is Huawei they can choose to siphon (or worse?) optical lambdas at will.

Platforms like this are common for submarine applications: http://carrier.huawei.com/en/products/fixed-network/transmis...

Which shouldn't matter. The network is untrusted.

Maybe. The !00g lambdas can be trivially encrypted end to end.

I'd generally agree with you but network position carries a weight and value. Being at the crux of a NAP has significant "free" upside meaning that I can easily DoS any downstream on the network and subjectively block, throttle, and generally impede others at will. I can also still easily manipulate critical services such as DNS, BGP and others as well as use my position for intelligence gathering and masquerading. Just because we shouldn't trust the network doesn't mean other services have the luxury of strong crypto.

Being "properly secured" isn't as simple as it seems because it's not a matter of simply securing against today's threats, but for those in the future, for as long as those communications need to remain secret.

It's possible, perhaps even likely that all communications would be recorded for decryption later when if / new techniques become available.

> Huawei put the industry on notice late last year, when it completed a cable between South America and Africa.

Somewhat tangential, but not I'm curious about how undersea cables deal with the tectonic plate movements and any volcanic activity on the plate boundary. Then I found this interesting article: https://www.sciencemag.org/news/2018/06/seafloor-cables-carr...

Undersea cables are laid with a significant amount of slack. It's needed for a cable repair ship to be able to haul up the cable from the ocean floor and perform repairs mid-span.

Looking at the cable map [1] makes me wonder, what do they do when cables are crisscrossed over and under each other?

[1] https://www.submarinecablemap.com/

If a cable is picked up with another cable on it, the latter one just slides to the side?

China Telecom’s Ace in the Hole: BGP Hijacking

"China Telecom (CT) entered North American networks at the beginning of the 2000s, and has since grown to have 10 PoPs, eight in the US and two in Canada, spanning both coasts and all the major exchange points in the US. Few other non-American ISPs has such a wide-spread presence on US soil."

"Using these numerous PoPs, CT has already relatively seamlessly hijacked domestic US and crossUS traffic and redirected it to China over days, weeks, and months as demonstrated in the examples below. The patterns of traffic revealed in traceroute research7 suggest repetitive IP hijack attacks committed by China Telecom. While one may argue such attacks can always be explained by ‘normal’ BGP behavior, these in particular suggest malicious intent, precisely because of their unusual transit characteristics – namely the lengthened routes and the abnormal durations."

:s/CT/Huawei/

Source: https://scholarcommons.usf.edu/cgi/viewcontent.cgi?article=1...

The US may be able to strong-arm some close allies into shutting out Huawei, but it will not be able to do so globally. Huawei beaome the world's largest telco manufacturer with low prices (their market share is ~32%, twice that of #2 Nokia [despite absorbing Siemens, Lucent, Alcatel etc!]), but these days their technology is better than the incumbents as well:

https://phys.org/news/2019-02-european-telecoms-dilemma-huaw...

This whole thing is about ease of spyware access by intel agencies, fuck em both.

I don't understand the comments here. TFA article says nothing about data capability, just that Huawei is in the business of running physical cable. TFA doesn't even state whether L1 repeaters are Huawei's equipment (part and parcel with the cable) or someone else's (Huawei just being physical installer).

This article is completely worthless.

Poorly done PR.

Breaking News: The Suit is Back! http://www.paulgraham.com/submarine.html

why are people so afraid of huawei? they are just a telco. they provide infrastructure. sure they can snoop on unencrypted traffic, but thats not their core business. so who cares if the 5g is american, russian or north-korean. if i were the us, i'd be afraid of 1. google and 2. facebook. their business is actually spying and selling that information. these know more about americans than any other company. they see data that is actually sensitive and encrypted. just because they are american companies, does not mean they will not leak to foreign intelligence entities. heck those are very likely on their client list already.

I think you forgot about the Chinese government who is interested in siphoning and censoring information.

Yes, here is the voluminous evidence that we have presented that Huawei spies for the Chinese government. /s

https://en.wikipedia.org/wiki/Global_surveillance_disclosure...

Because they allegedly have strong ties to the Chinese government. So theoretically they could build backdoors to critical infrastructure used by ISPs and other network providers.

As for you main argument, we can worry both for Huaewei and Google/FB. It's not either or the other(s).

I am not sure about how we should feel about Huawei, but by this line of argument nobody could lay undersea cables or get anyone to use them.

From the article:

> The leader in the global undersea cable market is SubCom of the U.S. Japan's NEC and Europe's Alcatel-Lucent

Each of these have strong ties to their respective government and could build backdoors.

I don't think it is "strong ties to the Chinese government" as much as it is "literally the Chinese government." If you can imagine how uncomfortable other nations should be having the Chinese government running their next gen 5g telecom infrastructure everything makes a lot more sense. It's not just the USA that is refusing to use Huawei. Japan etc. have said hell no.

https://www.forbes.com/sites/zakdoffman/2019/04/20/cia-offer...

https://www.scmp.com/tech/tech-leaders-and-founders/article/...

So where is the actual evidence? Why won't the CIA present it publicly? Or should we just believe the CIA that it has this "evidence"?

There might not be any evidence. It might simply be the possibility of an update with backdoors/military payloads that gets pushed worldwide moments before a shooting war begins, or as a way to paralyze the world when negotiations become heated.

Huawei is a private company. The logic of this argument is that no Chinese company whatsoever is reliable. There's literally nothing Huawei can possibly do to allay the fears of people who take this attitude.

I don't think anyone who knows anything about China believes "private company" means anything in that country. The founder was literally a PLA and a huge amount of private ventures have deep ties to both the CCP, either in funding, talent or both.

It's not a coincidence that APT steals IP and "somehow" Chinese companies have advanced 20 years in research.

"Private company" means a lot in China. The state-owned enterprises operate very differently from the privately owned businesses. Tencent and Alibaba are dramatically different from state-owned enterprises.

> The founder was literally a PLA

Along with literally millions of other Chinese people. Being in the PLA when he was young means next to nothing.

My concern is that even if the boardroom in Huawei and every single employee all the way down operated in good faith, there is nothing from stopping the Chinese government from taking control of the technology if they wanted to. This is a government that is currently operating concentration camps.

Every company is subject to pressure from their country's intelligence agencies. If an American company is ordered to spy on its customers, there's little it can do. This happened with Lavabit, which Edward Snowden used as an encrypted email provider. The US government forced the founder of Lavabit to hand over the website's SSL private key.

If you're afraid of a foreign country using its technology providers to spy on you, you have two options:

  1. Don't use technology from that country.
  2. Only use technology from that country that you are confident you can audit.

There's nothing Huawei can do, beyond what it's already done (offer to open up its tech for audits by foreign intelligence services), to allay the fundamental fears you're expressing. In the same manner, there's almost nothing American companies can do to allay the fears of foreigner countries (or US citizens, for that manner) that their tech won't be used by American intelligence agencies. The logical conclusion of this is that every country must develop its own technological base, and that's not a future I want to live in.

The concern is legit. That's why Huawei is the most audited telecom equipment provider. Also that's why U.S. has hacked into Huawei years ago. I am pretty sure if there is anything, it would have surfaced years ago. In a way, the whole thing has made Huawei more reliable than other provider if you object monitoring from U.S. government.

Ren Zhengfei retired from the PLA before he founded Huawei. I don't see people accusing companies founded by US veterans of being "literally the US government". Yes the PRC is a single-party authoritarian state, but it has a whole set of laws defining private companies vs state-owned enterprises.

The only concern about Huawei is that it cannot disobey Chinese government orders issued against Huawei's will. (Sounds familiar? All those companies that dropped Huawei due to an US government order? How so many were being apologists for Google because "Google didn't have a choice"?) Saying Huawei is "literally the Chinese government" without providing proof and asking us to simply follow the rhetoric by suspending all disbelief is a very lazy and dishonest tactic.

I believe. How many former PLA members in China right now? It is a job. How is it different from someone worked in U.S. Army before? It basically tells that you know nothing about China.

Huawei was looking to sell to Motorola, but then Motorola backed out.

I don’t think a company that is “literally the Chinese government” would be sold to a foreign company.

Fixed that for you: "Because they have strong ties to the Chinese government. So they refuse to build backdoors for the NSA".

> Because they allegedly have strong ties to the Chinese government

Do you know which telco companies have more connections to the Chinese government? Every other Chinese company. Even Foxconn which manufactures your iDevice has Communist representatives in their management.

There is a longform article on Huawei which I can't find right now, but essentially it suggested that Huawei's ultimate authority is a "workers committee" which ultimately is controlled in turn by the Party.

That said, it's really not a stretch. To give just one example: There are strong suggestions that Microsoft got NSA money to buy Skype, principally so that MS would revert Skype to a server-based model and take encryption out. Whether this case is true or not, it seems pretty certain that the US government makes use of national players. And it would be incredibly far fetched to even imagine the PRC not doing the same thing.

https://technode.com/2019/04/19/who-owns-huawei-clearly-not-...

https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3372669

Someone posted this link the other day. https://zeihan.com/my-way-or-the-huawei/.

If enough people have a cold war mentality strategically it makes some sense. Combined with the chance to annoy the Chinese govt in the middle of a trade war, Trump will love it.

It seems I should be reading between these lines.

> The reality is, even if the U.S. succeeds in shutting out Huawei from 5G networks in major countries, the Chinese company could still thwart American efforts to maintain leadership in handling global data traffic.

> Security policymakers in the U.S., Japan and Australia have started working together to address this potential threat.

How is not maintaining leadership a threat? I would say it's a loss of market share and control to do as you please with the infrastructure. It's a threat in the same sense as citizens having encryption.

Because the Chinese government is dangerous and actively building a surveillance state and running a little genocide experiment at the same time?

And the US doesn't engage in mass surveillance or war? I'm all for sanctioning countries that don't respect human rights but if the US is really suggesting that then they should be careful what they wish for.

> maintain leadership in handling global data traffic

It's basically saying China doing what the US does is a threat, meaning that what the US is doing is a threat to others symmetrically.

It's a threat to five eyes's leadership.

> Japan and Australia have essentially closed ranks with the U.S., and the Donald Trump administration is pressuring Britain, Germany and France to do the same -- reportedly going so far as to threaten to withhold important security information if they refuse.

Australia cut off Huawei first way back in 2012/2013 when they locked the company out of Australia's 5G network.

I'm no fan of Trump but I don't see how it's relevant to bring his name into this. This would have mostly likely been US policy under a democrat administration as well. Who wants to bet in 10 years we'll find leaked documents showing Apple and Samsung US lobbied the commerce department for this? Who wants to bet Intel, Microsoft and Google are about to sue because they're about to lose a few hundred million a peace?

I'm curious if we'll see a Federal Court case on this within the next three months.

Apple’s recent revenue cuts are from China. I don’t think it’s in their interest to jeopardy that. They also need China for cheap assembly labor.

Given the billions western nations sink into “cyber security” you’d think those governments would have done something to make sure all civilian communications are properly encrypted. Instead we’ve got Parliaments writing dumb laws regulating cookie policies.

Bike shedding in the government? But who will think of the children!

And what color should we paint them?

Those two things are orthogonal. Pervasive online tracking wouldn't be fixed by implementing "proper encryption". Google will still track you, HTTPS or not.

Besides something tells me that the same people who oppose things like the GDPR wouldn't exactly applaud if governments decided to pass a law to make TLS mandatory for instance. I'm sure if that were to happen we'd soon hit semantic satiation for the phrase "regulatory capture" in this very forum.

So what exactly do you propose governments should do to solve this particular problem?

I think you'd be wrong. Most ad tech companies use TLS and would be happy to comply. The cost of compliance is low. The gains are pretty big.

To second this, it's my understanding that Google for instance is a proponent of transport security as it helps prevent middle men (ISP's, etc.) from stripping and replacing ads in transport.

Are there any good links about ‘landing stations’?

https://www.submarinecablemap.com/

One of my more ancient bookmarks: http://atlantic-cable.com Mainly history of the first transatlantic link, but also lots on Widemouth Bay and Porthcurno - the two landing stations.

Widemouth Bay is the still active one with a GCHQ intercept nearby.

Tom Scott had a pretty good video about them: https://www.youtube.com/watch?v=nl2mQ2HiJZc

Minor correction: Tom Scott's video is great, but I was actually thinking of Motherboard's video which talks about modern undersea cables: https://www.youtube.com/watch?v=iMAThVcqzuk

Cryptome is a classic source on topics like this [1]. As for what a landing station looks from the inside, Ars Technica had an excellent series [2] on submarine cables in 2016.

[1] http://cryptome.org/eyeball/cable/cable-eyeball.htm [2] https://arstechnica.com/information-technology/2016/05/how-t...

Tangentially related is this classic long form piece by Neal Stephenson from a 1996 editon of Wired "chronicling the laying of the longest wire on Earth". A great bit of recent transoceanic cable history.

https://www.wired.com/1996/12/ffglass/

And this piece served as his source research for the fiberoptic cable network portion of the plotline in Stephenson’s novel, Cryptonomicon.

https://outline.com/R7vGvk is an outline version of the very good (from 1996...) Wired article, "Mother Board Mother Earth" https://www.wired.com/1996/12/ffglass/

Meanwhile, FiveEye countries have been intercepting data through these cables, all over the world, for only God knows how long [0] [1].

Which is a common theme for this anti-China/Huawei push: Just accuse them of everything we are already guilty of. Anybody pointing out the hypocrisy can just be shut-up with a good dose of "whataboutism!".

[0] https://www.theguardian.com/uk/2013/jun/21/gchq-cables-secre...

[1] https://www.smartcompany.com.au/finance/economy/telstra-s-de...

> Anybody pointing out the hypocrisy can just be shut-up with a good dose of "whataboutism!".

And that would be a completely appropriate response if someone were to imply that the US' actions somehow justify China's actions. Or vice versa.

well if you're neither American or Chinese which is true for most people on the planet and you have to weigh which supplier of infrastructure you choose then you do indeed need to weigh who is the worse actor. That's not justification, it's just an evaluation.

Sure, but what you are describing is much different than "pointing out the hypocrisy"

Not really, because as a German I've been directly affected by said hypocrisy and even when it came to light [0], quite spectacularly too, nothing changed.

That's why I consider this current push of "China spying on everybody" quite cynical as it tries to sell a narrative where FiveEyes spying is the benevolent BigBrother only trying to protect us, but Chinese spying is evil incarnate.

At this point, Germany might as well just go full-on post-privacy and just share all data about everybody with everybody, instead of playing these pretend games of "We care about privacy, except when it's in the way of US national security interests", which is an extremely weird stance to have for any country that's not the US.

[0] http://www.europarl.europa.eu/document/activities/cont/20140...

Especially when you live in a small country that has historically been a stalwart ally of the US, and now has to reevaluate in the face of an increasingly purely transactional approach to alliances from the US.

Maybe this will result in net growth of global telecom infrastructure. After all, we can't allow there to be an underwater cable gap!

"Virtually all of the world's data transmissions go through cables on the bottom of the oceans."

I'd be mildly surprised if me posting this comment went through a cable at the bottom of the ocean, but who knows?

Somewhat related: How difficult is it to access the "uncensored" internet for Chinese nationals (in China)?

I can guess, but I'm sure other users know better.

Last time I was there it wasn't too hard. But it depends on if the Chinese government is blocking your VPN or not. I usually connected to Seoul or Hong Kong.

Are people there worried about being prosecuted (maybe severely) if they're caught bypassing the censorship?

No. Reading censored foreign media doesn't get you in trouble, and it's extremely widespread. Posting anti-government opinions is what gets you in trouble.

At the time no. But things have really changed. That said, my family lived through the Mao era and the Cultural Revolution, etc. Terrible things can happen but the rule of thumb for China, in my opinion, is that China (and probably any other authoritarian country) does not tolerate another nexus of power. Reading censor material is not so bad. Disseminating it will get you in trouble. Trying to speak out against the government and disseminate that opinion will get you disappeared. For example, Catholicism was banned in China for a long time until the Pope made a deal that gave the government a voice in the appointment of bishops. What made Catholicism problematic is that there is another authority figure in Rome. Buddhism, in the form commonly practiced in China, has no such figure which is why it was tolerated and sometimes even promoted (with a very nationalist slant). Tibetan Buddhism, on the other hand, has an authority figure not controlled by China. You get the idea...

It seems like it is a simple concept that you are getting at. Authoritarians want te prevent other seats of power. It makes me wonder about what the growing Chinese middle class wants.

EDIT: But back to the question. I think the answers make sense. It's easy to bypass if you are savvy (as we know already) but if you challenge govt they would take offense. I guess the grey area would be anonomous critique, but I digress; thanks for the response.

So your point about anonymous critique is somewhat true. It's actually a little more sophisticated than that. Critiques often come in the form of historical parallels. For example, rather than critiquing Xi for having a bunch of "yes" men, some high up official in the party lauded the achievements of Tang Taizong -- the second emperor of the Tang dynasty. He's generally considered an exemplary ruler but the other trait known about him is that he was open minded and sought out people who disagreed with him. China became very cosmopolitan under him and the silk road connected China to far away places (it's the inspiration for Xi's Belt and Road Initiative)

So in praising Tang Taizong, the official was critiquing Xi's inability to deal with differing opinions.

This isn't a new thing, BTW. Chinese scholar-officials have been doing this for ages. China has historically been a very authoritarian country and the same ideas applied then (kind of). This is one reason why historical Chinese officials were (ironically enough) criticized by the Communists for being backwards looking. Straight forward critique wasn't allowed during the imperial eras so they always had to find historical parallels to vail their critiques and advices.

Interesting! And quite ingenious to hide critique in praise.

It is less about bypassing the censorship, more about what are you trying to do bypassing the censorship. I don't think you will have any problem reading stuff. Transferring information may cause you big trouble. As individual, I do not think you should worry about it at all.

It's not hard, but it's not easy and certainly not reliable. This is a good video on the topic, not exactly about your question but they do cover it. https://www.youtube.com/watch?v=6lM_vvmTB_4

Only a few people with good enough English can/are willing to read serious articles.

One of the things you will see is that a VPN will work for a while.

Then it will stop.

Even though they may not be able to break the crypto, it's not hard from a DPI (deep packet inspection) and netflow analysis perspective to see that an IP in China has a high volume of encrypted traffic to/from a single /32 in the US/Europe, and then blackhole that.

The GFW has automated null routing/traffic blackholing functions in place for this.

Are there currently any (CLI) tools that route traffic through multiple IPs (I mean not tOR)?

For example, multiple SSH tunnels through something like sshuttle where you try to give the impression that you are not threading all your traffic through one "hole".

Not aware of any measure like that but shadowsocks is the one obfuscation method that has been able to bypass the GFW in China for a long time now.

Always impressed that it still manages to work.

It's not too hard but in the meantime it's not trivial, either. I worked for a multinational corporation in Beijing so in the office (or outside the office via corp vpn) we were allowed to access sites such as google.com.

I paid for a vpn service so for personal stuff I was able to access every single site on the Internet. I did this for over two years and never got into any trouble. My impression was that nobody cares if you find a way to browse facebook, twitter, wikipedia as long as you don't use that opportunity to incite subversion of the government or some similar shit.

In my school (top 20 university in China), it's common for students to use vpn. And I think plenty of programmers in China can set up their own vpn servers. Also there are many YouTube videos forwarded to video sites in China.

Here comes Spacex Starlink + bezos copycat company with better then cable latency :)

They're unlikely to be competitive on capacity though. I expect, in most cases, these satellites would relay you to a ground-based base station with as few satellite hops as possible.

With every launch, SpaceX will add about a terabit of “usable capacity,” Musk said, and two to three terabits overall. You probably right. But all those satellites that are above the ocean at the moment they can be used to transmit data over sea's or between small islands. In this way it will compete with optics. Think of countries like Indonesia.

Two to three Tbps aggregate won't change much except maybe for islands that are currently dependent on VSAT.

Reply on news.ycombinator.com