US says it can prove Huawei has backdoor access to mobile-phone networks | Hacker News Reader

US says it can prove Huawei has backdoor access to mobile-phone networks

arstechnica.com

261 pointsssully276 comments

> Telecom-equipment makers who sell products to carriers "are required by law to build into their hardware ways for authorities to access the networks for lawful purposes," but they "are also required to build equipment in such a way that the manufacturer can't get access without the consent of the network operator," the Journal wrote.

I love this quote. The US is essentially complaining that Huawei has access to the backdoor channels that only the US government was supposed to have.

>The US is essentially complaining that Huawei has access to the backdoor channels that only the US government was supposed to have.

How is surprising? The defining characteristic of a nation state is that it has a monopoly on violence within its borders. Having a monopoly on intercepting telecom traffic is a logical consequence of that. For other countries though, yeah I'd prefer if neither China nor US have backdoor access.

"I'd prefer if neither China nor US have backdoor access."

So would I, but having lived in both countries, one of the two governments is decidedly more evil than the other.

Well, you could think about it this way: its better to possibly leak data to a foreign interest if they don't work well with your country. Sure, they may have some data, but they wont share it.

U.S. government just has much better PR, thanks to Hollywood, but it isn’t that much better than Chinese one.

What is more dangerous for an American (or even European) citizen? The US or China spying at them? Even if China is more evil in its domestic affairs a western civilian has much more to fear from the US.

>Even if China is more evil in its domestic affairs a western civilian has much more to fear from the US.

Can you support this assertion?

Kim Dotcom, Julian Assange, Iraq, Iran etc.?

FIFA executives. Even though I found it awesome.

https://www.justice.gov/usao-edny/pr/nine-fifa-officials-and...

China can't prosecute me for anything, U.S. can.

America are more likely to kidnap me over the borders compared to China.

Source?

To quote a Chinese citizen: “Give us a baby and we’ll let you go.”

https://www.hrw.org/report/2019/03/21/give-us-baby-and-well-...

Millions of Chinese people visit the US. This is who China would be most concerned about monitoring anyway, and who we should be most concerned about protecting.

They have more to fear from China.

China does not respect the sovereignty of other nations, nor the rule of law. They are not above intimidating, blackmailing, or otherwise exerting their influence on foreign nationals on foreign soil when their views become too politically inconvenient.

Those residing and holding citizenship abroad but that have family back in China (which are many) have proven especially vulnenable.

Stories of China arresting foreign citizens for activities abroad and never allowing consular access, funding and manipulating groups in foreign countries (especially on university campuses) and then directing them to silence others, and more are a dime a dozen.

While the US's hands are quite dirty here as well, China has shown repeatedly that given the opportunity they are more than willing to try and implement the kind of oppression and thought policing they have at home in places abroad. It is more dangerous for the entire world to have China spying on them than it is the US.

This is the same USA which performs extraordinary renditions (ie: kidnapping a citizen of a foreign nation from within that nation’s borders), political assassinations, and abandoning erstwhile allies because their new friends with oil don’t like the old friends?

How is China worse than the USA? Your claim seems to rest entirely on greater reporting of China’s aggressions by the US and their allies.

His claim rests on the reported facts by the US and allies? There are independant agencies outlining so much worse.. like the harvesting of organs on political prisioners.

Do you think the US is harvesting organs?

Probably not, but the US has started more than a few wars which has led to insane amounts of suffering and dragged it's allies into it as well. This, as a European, I fear more than China's foreign policies.

However I am truly afraid of the way Xi has enacted its horror policies in China.

Russia borders Finland, and your air force flies 60+ F/A-18s. I believe that US military power is among the most significant bulwarks of peace and prosperity in your country.

That is whataboutism.

The US routinely massacres innocents in foreign countries then retroactively declares all the victims “terrorists”. China — to my knowledge — doesn’t engage in anywhere near the level of military aggression that the USA does.

When you compare the number of organ harvest victims to the number of “terrorists” slaughtered by incorrectly targeted missiles, who comes out ahead in the ethics game?

Do you think killing people for the sake of imaginary goals is better or worse than killing people to harvest organs?

> While the US's hands are quite dirty here as well,

Acknowledged this already.

The policies the US is trying to enforce with these measures are less bad for most of the Western world than those that China is. That's it.

While the US has taken quite a slide on freedoms over the past couple decades, they're still nowhere near China's level and I find it pretty laughable to even try and put them on the same playing field in that regard.

Well, the PLA has been caught red handed, twice, hacking Western firms and financial insitutions, including installing malware and identify theft which could be used to impersonate and hack members of the public. The USA is far from clean on this issue, but I don't think we know enough to properly characterise the relative threats.

https://en.wikipedia.org/wiki/PLA_Unit_61398

And the NSA has been known to monitor all kinds of communications "which could be used to impersonate and hack members of the public". (example: https://en.wikipedia.org/wiki/Tailored_Access_Operations#NSA...)

The ideal would be to use open-source hardware and e2e encryption, but if this is not possible I would suggest these scared of the US to use Chinese phones and these scares of China to use US phones.

The answer is obvious for citizens of either country, but the the answer is different for citizens of neither country.

China has historically not engaged in violence far from its borders. America frequently does.

nearly 20 years ago, George Bush talked about 'evil' countries, sent troops, and...

unless you are under 25 or deeply religious, I'd suggest to think twice before using 'evil' on subjects of international politics.

evil is a good word with a defined meaning. Having it mis-used should not stop us from its correct usage. Yes absoultely be vigilant about its use, the specifics and be very suspicious of generalities of "evil" in nation state politics. It's reasonable to describe the actions of any government as evil when it meets the definition.

Was George Bush Jnr performing the actions of an evil man? Discuss.

does every group supports any math operator? does every word have meaning in every domain? I don't think so.

as a US Resident, China has no authority to murder me or put me in a cage like the US Government does.

So if I had to choose I would prefer china over the NSA, Of course neither is the best option but .....

if I lived in China the inverse would be true

That argument really only works if you're a political activist or even an average citizen. However, if you're a high level executive, defense contractor, or a high ranking government employee, do you really want the Chinese government to have access to your comms AND know your movements?

So 98% of American citizens then.

good thing I am just an average American citizen then

This is dangerously naieve and short-sighted. Look at how readily China already uses our own corporations against us. ESPN showed a map of china with the nine-dash-line. Hollywood won't dare to offend the Chinese government. Our tech companies are willingly censoring themselves. Our corporations influence our politicians, and China is exerting influence on our corporations.

If they have access to an enormous volume of potential blackmail or datamining, you think they won't use that against us for political gains? They could blackmail a programmer to insert a subtle vulnerability into a piece of code by threatening to expose his extramarital affair, or threatening to tell his employer/family/friends what kind of porn he watches. Or they could easily datamine and target those with monetary issues to see who is vulnerable to a bribe. Or they could threaten to frame you for child porn using their backdoor access.

This is from a government that isn't afraid to 'disappear' political dissidents, send people to "re-education" camps, harvest organs from their own people. You think they're going to be friendlier to American citizens?

> You think they’re going to be friendlier to American citizens?

Yes, because American citizens are none of their business. Law enforcement and prosecution on the other hand is very interested.

...but US corporations are their business?

China, and the US for that matter, will generally do what they think they can get away with to further their interests. Regardless of a bunch of imaginary lines drawn on a map.

hm.. China backs their multinational corporations into competing with other businesses globally. For example TikTok or all the construction firms that compete in Africa, Asia, etc.

Now let's imagine I am an American citizen/businessman competing with a Chinese businessman. I have a better product, better networks. Let's also imagine the scenario where the Chinese govt has more power and dominance than anybody else in the world. Do you still think an American citizen is none of their business?

How about if an American citizen happens to write an article criticizing Chinese govt? What would happen in the above scenario?

So then the solution is to ensure NO GOVERNMENT has the ability to spy on people

Not to lambast china while excusing the US Government that requires that type of spying by law.

Do you believe that the US Government is above " blackmail or data mining" or "won't use that against us for political gains", both of which has been proven to be true

Everyone is Soo fucking afraid of foreign influence on our politics they ignore the domestic influence of the same nature.

Personally I believe the NSA and CIA to be more dangerous to our liberties than China or Russia.

As Lincoln said many many moons ago, If we lose our freedoms it will because we destroyed ourselves

As far as the tech companies / Hollywood censoring because of china, for the product in china sure but they censor their products here because they want to, china is just a convenient excuse that naive people believe. It is a way to shit shift the blame "no no we did not want to, big bad china made us" bullshit

In western countries you can, in general, publicly mock your leaders on the front steps of your legislature. Try dancing in a Winnie-the-Pooh costume in front of the Great Hall of the People and see what happens...

Because in China is the power is indeed in the hands of the government. Not sure this is the case in the west anymore I'm afraid

I'm pretty sure China has a "deep state" too.

publicly mock your leaders on the front steps of your legislature

So long as those steps are designated as a "free speech zone".

Oh boy, the worst thing that will happen is that you might have to move a little ways down the street. Horrifying.

That is a naive view to look at a situation where an armed man is telling you at gunpoint to "move a little way down the street" with the implied ending to the statement being or I will shoot you, or forcibly remove you to an iron cage

People always seem to forget, all government actions and regulations no matter how small are acts of violence. They are not voluntary and are backed by the threat of legal violence to anyone that dare resist.

I don't like the ridiculous idea of "free speech zones" but law enforcement does need to be able to move people who block streets or doorways. It should be independent of why the person is there. Of course they shouldn't shoot them.

Your comment has nothing to do with what you replied to. It wasn't about what country is better.

True. I completely misread the comment to which I replied. Oops! However, my preference is still to live in a socialist country where the government can be openly criticized.

In practice, we're not just talking about the US backdooring telecoms systems within their own borders. They were caught red-handed compromising exactly these lawful access systems in the European allies they're now leaning on not to use Huawei telecom systems in order to tap their politicians' phones.

Seems like convenient timing, no?

>The defining characteristic of a nation state is that it has a monopoly on violence within its borders.

Pedantry FYI, that’s just a state. The term “nation” has more to do with distinct communities and culture. And so a “nation state” is when those overlap.

Pedantry squared FYI, but because the United States calls their provinces "states", it's helpful to disambiguate by adding the word "nation".

Furthermore, since a nation is a group of people bound together by shared culture, values, religion, language, etc., while a state is a piece of land with a defined border, then nations and states are not necessarily the same thing.

A "nation-state" is the intersection of the two, where cultural boundaries align with political and geographical boundaries, and not a redundant synonym of "state".

>The defining characteristic of a nation state is that it has a monopoly on violence within its borders.

That seem like a good reasons for people within US borders to prefer to be spied on by the Chinese government rather than the US government and for people within Chinese borders to prefer to be spied on by the US government rather than the Chinese government.

If I have to be spied on, I will choose whoever is less likely to subject me to violence.

They pulled the same like when I was trying to buy a little yellow cake uranium. The government is so hypocritical.

The features they aren't talking about aren't a "backdoor". It is well a well document feature of most service provider networking equipment that allows for the provider to respond to subpoenas. The data collection is explicitly configured by the service provider. The allegation is that Huawei can activate the lawful intercept feature without authorization from the service provider.

The theory behind the lawful intercept concept is that with the appropriate legal authorization a law enforcement agency can get a capture of a subscribers traffic in a somewhat standard format - that way the LEA doesn't have to have a different way to process the data from each network equipment vendor.

Here is a description of how the feature is commonly implemented: https://en.wikipedia.org/wiki/Lawful_interception https://www.arubanetworks.com/techdocs/Instant_40_Mobile/Adv... https://www.cisco.com/c/en/us/td/docs/routers/10000/10008/fe...

I'm sure the NSA see's this completely differently. While I understand what you mean, it's very hypocritical when you have agencies like the NSA rolling around.

Australia called, and wants its irony back.

That's a bad take.

There's a huge difference between a documented authorised-only interface and an undocumented backdoor.

Let’s say it is hypocritical — and China is fully within its rights as a nation to attempt to do this — that doesn’t mean the us should just let them get away with it.

Let China keep the nsa out of their networks and we’ll keep China out of ours.

Note: The following might be considered off-topic. On the otherhand, there might be something nefarious in the SMS network.

I found something strange that affects SMS in Canada. You can send the lower case text "secure communication", but it will never be recieved by the recipient. I am not sure if this behavior is reproducible outside of Canada. It might be a software defect, or perhaps there is something capturing the text and trying to interpret it as a command. The issue is more difficult to reproduce if both the sender and recipient devices are iphone's due to the default behavior of sending via iText.

I originally posted about this late last year [1]. I intend to investigate this issue more deeply, but my time has been consumed by another more pressing matter. The original HN post links to my blog post [2]. Originally I jumped to the conclusion that it was a case of censorship, but I backtracked on that because the issue is case sensitive. I would love confirmation if this is reproducible in other countries.

[1] https://news.ycombinator.com/item?id=21593276

[2] https://bloggerbust.ca/post/text-messages-are-being-censored...

I just tried that in Quebec from Virgin Mobile (Bell) to Vidéotron using a Samsung S10 and a Samsung A8, it's working fine for me.

I can't verify it is send over SMS or MMS though. In theory there's no reason for my cellphone to send it over MMS.

The exact word used: secure communication

Turn off your data and disconnect from wifi, then try again. I believe that will force it to send via SMS. You might need to go through your client's app settings.

The Google Android client is nice because it displays what protocol it is sending over. It is important to confirm that it is sent over SMS. Also, it is important that the words "secure communication" are sent in all lower case which I see that you did.

Thank you for taking the time to test this. If you are sure it is being sent over SMS then I will add your entry as an example where it can be both sent and received

Just tested via twilio to canadian cell phone and had no issues receiving it.

What client region was the twilio data center? What was the exact text sent? Are you comfortable to disclose the make / model of the receiving cell phone as well as its carrier service?

I just tested with twilio as well. I was able to send this string:

"secure communication"

from within the twilio API, via pure SMS (no imessage, etc.) to an iphone SE with a US Mobile (verizon MVNO) sim card.

Was sent from a US number to a US number.

No issues.

I added your entry, thank you.

I just tried without Wifi and mobile data (good idea!), it was send and received correctly.

I did it from my S10 to someone else A8.

It's a bit of a leap to assume that behavior like that is evidence of nefarious activity; ask yourself, if you were implementing some sort of secret signalling layer, would you design one that uses simple English words, and whose failure state reveals its presence?

Consider the other cases - it could be something like an anti-spam system; back when MSN Messenger was a thing, it would abruptly close any conversations in which certain virus-related keywords were said (mostly including ".exe", which is how I discovered it), presumably in an attempt to stop them spreading.

Or it could be a bug - there have been plenty of these, from simple strings causing mass IRC disconnections, to eerie conspiracy theories (see "bush hid the facts"[0], a conspiracy caused by a bug in Notepad).

Or it could just be a bit of debug code accidentally being triggered. This past week, I had to explain to some users why a website was talking about "DEAD BEEF". The reason was innocent (glitch in a web server config), but to the end user it was incomprehensible.

All that said, if you want to investigate further, it's simple to disable iMessage on iOS devices. If you go to Settings->Messages, there's a toggle for it.

[0]: https://en.wikipedia.org/wiki/Bush_hid_the_facts

I am not assuming that it is nafarious, I appologize if I was not clear enough on that point. There are many possible ways it could be the result of a defect and you provided some interesting examples. In either case, it is a curiosity worth investigating.

Thanks for pointing out an easy way to disable imessage on iphone. Apparently after doing that iphone defaults to MMS. It still might be best to just turn off data and wifi.

> back when MSN Messenger was a thing, it would abruptly close any conversations in which certain virus-related keywords were said

On MSN Messenger, one way around swear words in your username/status was to use the ASCII equivalent for a letter, which would get skip the filter but render as the letter.

So I looked a little down in my chart and hoped that 0x7 for BELL would do something, but it didn’t.

But 0x0 for NULL would cause all members of your contact list to immediately sign out and back in ad Infinitum.

Just tried this in Ontario, networks were Bell (iPhone 7) + Koodo (Pixel 3) and it didn't deliver.

Thank you.

I will update my records tomorrow morning with anyones accounts so long as they are confident the text went over SMS. It seems that not everyone can reproduce this issue, so that might help narrow down where the issue likely is.

Super busy now for a while...

I appreciate the time taken by the community to test this issue on their own devices and submit detailed results. I have updated the article with yesterdays submissions [1]. Please feel free to email me or comment on my blog. All comments on the blog require me to manually commit them to my GitHub repo which might take up to a day depending on how busy I am.

[1] https://bloggerbust.ca/post/text-messages-are-being-censored...

Tried it, works.

Also seems to not deliver SMSs that contain other combinations with 'secure communication' within it.

E.g.

'Hahahaha juice secure communication james'

'Not secure communication'

Yes, if the words "secure communication" in all lower case appear anywhere in the message, then the message won't be delivered. There can even be text appended to the beginning and end of the words [0]. i.e. foosecure communicationbar will also not be received. However; there must be exactly one blank space between the words.

Having said that, this is not working for everyone. I am trying to gather data on this to figure out where the issue might stem from. Would you be comfortable disclosing the make/model and carrier service of the sender and receiver. If you would prefer, you may contact me directly with this information and I won't include your identity in the record. My email is linked in the header of the blog post. I also have a public key [2] if you feel so inclined to send me a secure communication :-P

[0] https://bloggerbust.ca/post/text-messages-are-being-censored...

[1] https://bloggerbust.ca/about/#my-public-key

Message is not delivered between Koodo -> Koodo, secure commmunication (using 3 m) won't be delivered as well.

I wonder, but will not test, what happens if you put some code in between secure and communication. Like “; OR 1=1”.

I just tried. Successful delivery.

from: Freedom Mobile to: Freedom Mobile Location: Ontario

Mobile data: off Wifi: off

Side note: So cool to see so many Canadians on here! If requested I can send SMS to USA numbers.

> If requested I can send SMS to USA numbers.

Yes please! Also, if you have US contacts that would be willing to test US-->US and US-->Canada that information would also be valuable and appreciated.

Please include as much of this information as participants are willing to provide:

  - OS+version of mobile device
  - if WiFi / data was on or off
  - Carrier of sender / receiver
  - region
  - exact text sent

> I found something strange that affects SMS in Canada. You can send the lower case text "secure communication", but it will never be recieved by the recipient.

This reminds me of how, until just a few years ago (as late as 2016), people were wondering why you couldn't tweet the phrase "Get better".

It turned out that you can't tweet any phrase that begins with "Get" because... you guessed it, posting tweets from the web interface still shared backend code with the SMS-based system[0]. So it would interpret "Get foo" as an API request to fetch tweets, not a tweet itself.

[0] Twitter was originally designed to work on dumbphones! You could text your tweet to 40404 and it would post for you, or you could fetch tweets by saying "GET chimeracoder" and it would fetch the latest tweets from user @chimeracoder.

You could also go Google searches via SMS.

Your [0] is funny to me because that was how I used and communicated with friend groups back in the early 2000s. Years later when Twitter blew up for real it was strange that facet was forgotten and the culture moved on. That's also the reason for the 140 char length vs the 160 or whatever the SMS limit is. The other characters were reserved for their username.

I found that an international SMS containing the entire text for a Wells Fargo SMS 2-factor code from the US to the UK doesn't deliver. Found that interesting.

I could get it to deliver US to US, though.

A lot of shortcode systems fall apart outside of their home system.

These are common problems for those that try to go “data-only” and sign up for a virtual SMS service: they can’t receive 2FA SMSs.

I guess the positive is that it’s hard(er) for a bad actor to pretend to be bigger than they are.

On a related note, if you start an SMS with "!", then the leading exclamation point will be stripped, and a delivery confirmation SMS will automatically be sent (not sure if it's from the mobile network or the receiving phone). This makes it possible to send zero-character SMSes.

Ha! I respond to texts with a single "?" a lot of times, so it's funny to know that they're getting a blank text

That is interesting. I will try that out later today.

Huh, just tried it and the ! got through. Could be network- or encoding-specific?

Just tried Public Mobile (Telus sub-brand) to Rogers phone. And vice versa.

Messages containing "secure communication" failed when sent by SMS.

Both are iPhones, but one phone had wifi and cellular data disabled to force the SMS failover.

> required by law to build into their hardware ways for authorities to access the networks for lawful purposes

A bit of a tangent but ...

How I hate this term "lawful purposes". It's a non-sequitor / dark pattern deployed to confuse consumers into not understanding that they mean "spy on you". "Lawful" just means compliant with the law. In other words, they are are NOT saying "necessary to enforce the law" which is what they want you to think. They are only saying, hey, we won't break the law when we use this feature, aren't we great? Like breaking the law would ever be OK and as if this disclaimer somehow adds any sort of reassurance. The implied logic is "normally we would just break the law to access your data but in this special case we'll follow it.

/tangent

Are you sure you’d want to live in a society that was incapable of spying on you when they decided it was necessary?

(This argument hinges on that pesky word “necessary”. But it’s worth thinking about which conditions you’d be ok with the state surveilling others, and who exactly “others” refers to.)

> who exactly “others” refers to

Historically, people of color and political dissidents.

Sadly, that is exactly how ideas like that promulgate. It won't affect me. It will only affect the others, the undesirables, the trouble makers, and misc. whippersnappers.

I know it will not affect me and people like me, because implemented rules will ensure that.

My parents lived in a society you seem to yearn for. Hard pass.

I think that's a perfectly reasonable debate to have.

However that's exactly why I think they should not use deceptive language to confuse people. People need to understand exactly what is being done to have trust in it and to debate it so they can form reasonable opinions - not be deceived into thinking one thing is happening when actually something much more intrusive is going on.

NSA: Yeah, their spyware install totally broke our spyware install!!1!

Joking, but I honestly wonder- If the software is compiled in California... and the hardware is made in China. You could have two implants in the same gear. Now that's Thinking Green! Twice the government implants in one product.

"US says it can prove Huawei has lawful intercept access to mobile-phone networks" would be a better headline.

Because Huawei is a global law-enforcement agency and hence can claim lawful interception on all equipment it sells? Doesn't make any sense.

Is NSA a global law-enforcement agency? https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...

Completely depends on the abilities of the military which enforce the rule.

Violence tends to be the way nations define rules outside their own borders.

Inside their own borders as well. States are creatures of violence. They are created by violence and require continuous violence to remain in existence.

Why does it make sense for Cisco then? China is certainly a law enforcement agency, with just as much right to require it as the US does under CALEA (local US law).

"lawful intercept access" is the name of the feature, in that sentence.

But can they prove it without revealing their own backdoors?

Or explaining why they allow those backdoors exist in the first place?

Pretty sure it's legally required by the Communications Assistance for Law Enforcement Act[1] from 1994. I'm not 100% sure, however.

1: https://en.wikipedia.org/wiki/Communications_Assistance_for_...

Back in the day calea compliance meant you had to provide network connectivity and a signaling mechanism to specify what you wanted to be replicated to you. That meant voice calls and in some cases defining a network acl for packets (I knew folks who had to implement at router manufacturers - it was a hack that reused some of their multicast code base). The key part was an operator couldn't login to a device to see a calea intercept in progress or who was targeted. However due to the nature of how the replication/intercept was implemented you could see the results of it. High cpu, traffic leaving the box that didn't make sense, etc. I know one vendor who actually provided the trigger to the govt in the form of a snmpv3 query (and the communtiy string was hard coded in the os/binary...).

This is one of those "if X has access, so does everyone else" and rule makers still don't seem to grasp it.

"Because I can log into my sshd, so can everyone else"...? We are not talking about weak crypto here (though AFAIK 5G crypto is designed to be decidedly not E2E), but rather access to the data processed by these systems. There is no particular reason why granting e.g. the NSA access to a stream of CDRs would immediately give others access.

Why would the UK or Germany be interested in granting the NSA access? Those are some of the places where the US government is spending lots of effort to keep Huawei out.

So yes, any intervention like that seems to me to be less about "the Chinese can snoop" and more about "we can't".

If you're able to retrieve the private key, then yes, you're able to generate a working public key. If they even use a (pre-generated) private key. Often, passwords are even hard-coded in "firmware".

I don't think anyone is saying immediately, but these are long-lived fairly static systems.

I'm going to assume that you probably update your server's SSHd at least semi-regularly and that if SSH turns out to be broken 20 years down the line, you will probably be switching to something better either manually or when you eventually replace your hardware and reinstall the OS.

This kind of infrastructure is meant to last for decades. Imagine if the original GSM contained a backdoor with the state-of-the-art crypto of the time. Would it still hold up today? Hell, you don't have to imagine - a mid-range smartphone these days can crack a lot of GSM traffic.

Besides that, there's also the problem that not only are these things usually not done with state-of-the-art tech, but leaks happen all the time and it only takes one mistake* for the privkeys to become known.

just so we're clear, are we talking about lawful intercept (ie. capabilities built into the system so the telecom can comply with warrants), or dragnet or otherwise warantless surveillance? I'm not against "backdoors" for the former, but am against "backdoors" for the latter.

I mean, now you're just talking about intent, and thus have to trust that the intent is as claimed. Crypto doesn't discriminate on whether you have a warrant or not.

>Crypto doesn't discriminate on whether you have a warrant or not.

Okay, let's say the telecom equipment doesn't have a backdoor for lawful intercept. What happens if the telecom is served with a warrant? Are you expecting that the telecoms will refuse to cooperate with the authorities?

They shouldn't refuse, but they should be allowed to be unable to cooperate.

No, if there's no lawful intercept, they can cooperate fully, but it won't matter because there's nothing to get.

I'm not really making a statement about that. All I'm saying is that if you have a backdoor that can do the former, it must necessarily also be a backdoor that can do the latter.

They'd probably be able to co-operate anyway, but it'd require manual intervention by telco employees. What makes these US-mandated lawful intercept backdoors particularly nasty is that they provide an automatic way of exfiltrating data that is designed to conceal its use from employees - in essence, a built-in rootkit that compromises the integrity of telecoms systems even in countries that don't actually want this kind of backdoor. This isn't a hypothetical issue; the US has reactivated this feature to spy on politicians in countries that didn't actually want or need it on their exchanges in the first place.

> Crypto doesn't discriminate on whether you have a warrant or not.

Actually, backdoors could be implemented to require a cryptographically signed warrant. Think e.g. lawful intercept on mobile network routers, US (or any other nation's) law could just add this as a requirement. You could even develop a complicated scheme to apply this to E2E crypto.

But of course skewing the RNG to be predictable, or implanting some hardware backdoor, is much easier and has the added bonus of being usable to spy not only on your own citizens, but also on other nations.

Then it just needs a valid signing key. Every government (local, state, national) in the world has the right to a valid signing key.

terrorists and pedophiles duh :^)

"Or explaining why they allow those backdoors exist in the first place?"

Nobody that matters needs to be convinced of the value 'back doors'. Only a minority of the American public and privacy types are very concerned.

Certainly the other government agencies i.e. UK/Germany would take it as a given in terms of 'why' such back doors are there.

There's a reference above to the WaPo article yesterday revealing the longest-running and best surveillance program by the US. It was run out of Germany. The Germans were wary of using it too broadly, but they were otherwise fully behind it, and their intel agencies balked at closing it down.

It's not really even very political: certainly, Democrats would be 'mostly' onboard - there isn't really much of a political base against it other than perhaps the Libertarian crowd.

I should add, some major US industrialists like Apple and Google probably do care a lot, and they do matter and do have influence. But probably not enough.

So while many of us may disagree, it's not at the end of the day as controversial as we may think it is.

Pedophiles. It is always because of pedophiles.

> why they allow those backdoors exist in the first place?

To catch bad guys and protect the children.

China's intelligence law requires people or companies to spy when asked.

>“request relevant organs, organisations, and citizens provide necessary support, assistance, and cooperation”. According to Article 16, intelligence officials “may enter relevant restricted areas and venues; may learn from and question relevant institutions, organisations, and individuals; and may read or collect relevant files, materials or items”

https://www.canada.ca/en/security-intelligence-service/corpo...

Isn't this also pretty much the case with American companies? The only difference is that they need a warrant (which should be pretty easy to get).

Anyway, there is a new bill trying to kill e2ee in America https://news.ycombinator.com/item?id=22202110

Yes and no.

There are some specific carve-outs for telecom companies that their networks must have the ability to tap into specific traffic when a government agency comes knocking with a warrant.

But, as you point out, backdoor-free e2e encryption is not yet illegal, and the US gov't can't force e.g. Apple to put a backdoor in iMessage or in iOS's device encryption.

I expect that this is not the case in China; if the CCP tells a company to do something, anything, to allow them to spy on their users, they do it, or they get destroyed.

Bills like the EARN IT Act scare the hell out of me, but at least there's a process by which it becomes law, and we can affect that process and (hopefully) kill it. That's just not possible in China.

> and we can affect that process

In theory, in the same sense that one could influence what CCP does by becoming a member of it and rising through the ranks.

Counterpoint: CALEA and National Security Letters in the US.

not to mention recent revelations about how the FBI is gaming and outright misleading in the FISA court process.

Is it Telnet? https://www.theregister.co.uk/2019/04/30/huawei_enterprise_r...

I love the delusions here that spy craft is worth more than commerce.

China risks one of their largest companies, knowing they will eventually get caught, over one department in the US just puts out a statement they are 'spying' and everyone believes it without proof.

We don't actually live in a Hollywood movie.

"US officials said they have been aware of Huawei's backdoor access "since observing it in 2009 in early 4G equipment," the Journal wrote."

So the USA admits it's allowed all these counties, many allies, be spied on? Really? We are excepted to believe that?

I'm sure there's a technical 'thing' here. But whether they have fked up on the USA side or the Chine side we can only know from the US actually saying what this is. But then the US might lose it's 'Huawei is spying' attack on Chinese commerce.

While we're on the subject, is Signal still the best way for me to communicate privately? I've got all the people I communicate with daily using it now, and I feel relatively confident that the communications are private. Are they?

Open Whisper Systems has one of the most secure messaging services on the planet. The US military is rumored to have been telling operatives to use it instead of text on their government phones[1].

Edit: a word

[1] https://www.militarytimes.com/flashpoints/2020/01/23/deploye...

Given their demand to your phone number, along with social graph (phone list and communication targets) I do not trust it to be secure and private.

It's probably secure against phone company snooping. But I wouldn't trust it much past that.

Wire.com E2E encryption does not require phone number or social graph. They are also working to standardize the wire protocol via IETF MLS, with cryptographers from multiple companies.

https://datatracker.ietf.org/wg/mls/about/

Indeed.

I haven't gotten around to using Wire. But when I've needed secure, private, and semianonymous messaging, I've used Tox.

OWS is working on foundations to allow people to use usernames and link them with FCM / push notifications without the central signal server being any wiser than currently with just phone numbers.

My hope is to be able to add ephemeral user ids so to my work folks I'm JustMe but family folks I'm FamilyMe and internet blog readers I'm MyProfessionalMe

Is that proof "conflicted with NSA backdoor"

I don't hate that someone is investing in tools & research in this.

I'd certainly pay a 20% premium on my hardware for verifiable protection from phone-home. I'd probably pay that premium for the manufacturer to claim that the device doesn't phone home.

Obv different situation for infrastructure hardware where the end-user (me) isn't the same as the buyer (german telecoms, apparently). But I suspect some of the verification / testing tools will be similar.

I'm happy these topics are getting press, whoever the players are.

A question to Europeans reading this-

If you had to assume that U.S. 5G equipment manufacturers would provide backdoors to U.S. officials, and Chinese 5G equipment manufacturers would provide backdoors to Chinese officials, and Europeans had to use one or the other, which would you choose?

I think the answer would be none or both.

Between US and China? US, definitely. I don't exactly love the US, and would never want to live there, but China seems way more malicious than the US to me.

The answer is you choose the one which is the closer ally. Which, given the lack of US 5G manufacturers, is exactly the choice the US has already made.

After NATO would be gone, they will be allies no longer

Even if that is ever the case, US interests will still be way more aligned with Finland and Sweden than China.

How so?

For one thing, Swedes are less and less excited by the stream of Middle Eastern migrants caused by American adventures there.

https://thediplomat.com/2019/12/china-tries-to-put-sweden-on...

Fascinating

That's the point of the EU - defend interests of the union of relatively small countries against giants like China. NATO is only suited for military action, and who knows how long it's going to last anyway.

Also, probably the point of whatever the fuck Russia is doing with the EAEU (really should've picked a better name if they want it to stick).

I don't have an answer for this question but just to play devil's advocate, is this universally true or just sometimes true for governments and certain corporations? For example, as a citizen, is my data really better off with an ally, who can use it to exploit me instantly and personally? E.g. searches for medical information increasing insurance costs.

I don't think a nation-state threat is interested in your insurance prices, but regardless, what would an ally exploit that a non-ally wouldn't?

As regular nobodies, our data is probably distributed in the hands of both allies and non-allies. As long as there's such a strong push, both commercially and institutionally, for tracking and data mining, our only recourse is going offline.

No one wants our specific dental bills, mortgages or tax returns, but governments and corporations love mass statistics.

As soon as you're a "problem", e.g. because of a large insured event or ownership of property that someone wants to buy below the market, you're on someone's radar. At that point you no longer get the "regular nobody" defense.

The closer ally is likely to have SIGINT sharing agreements with your government.

FVEY exists so that the UK or Canada can legally spy on my communications and turn that data over to my government - which couldn’t otherwise get it without warrants and other pesky civil rights protections.

I think I’d rather take my chances with an adversarial government. I know they’d be spying but their ability to act on it is far more limited.

I think you are suggesting a false dilemma. Do you think those sharing agreements will vanish if AT&T hangs some Huawei radios on their poles?

No. But I regard my biggest threat as my own government, and if my choice per the GPs hypothetical is “less information to my government and some information to a foreign power” or “all collected data to my government and none to a foreign power”, the first choice is best for me.

Now, it may be fair to argue that the information collected from a 5G radio doesn’t mean much at all to my government. But I’d still rather depend on defense in depth.

Are you American? If so, that is a false statement. DODI 5240.1-R says "[DoD components] Will not participate in or request any person or entity to undertake any activities that are forbidden by E.O. 12333 or this issuance." [1] The NSA, which has the SIGINT authority from EO 12333 [2], is a component of the DoD. A non-DoD entity, such as FBI, Treasury, etc, would (a) not have a foreign intelligence mission and would therefore go through normal court procedures to obtain warrants to collect your communications or (b) would need to coordinate through the executive agency (NSA in the case of SIGINT) to request support for foreign communications, which brings us back to the referenced DOD instruction requiring FISA approval.

1: https://dodsioo.defense.gov/Portals/46/DoDM%20%205240.01.pdf...

2: https://www.archives.gov/federal-register/codification/execu...

Snowden showed they were sharing nudes of ex-girlfriend in TAO.

How well do you think the FISA warrant process is going in reality?

The scenario you mention is an illegal anecdotal failure of the system to work as intended.

If we're still comparing the US and China, I'd say it's working a great deal better than whatever system is currently (not) protecting Uighurs from systematic unjust search and seizure.

That it's illegal doesn't mean that we should pretend that it's not happening.

Moreover, there's much more than anecdotal evidence. The recently-released report on the Trump investigation proves this. Even if you hate Trump, there's no getting around the fact that the FBI completely abused the FISA court system, getting warrants by lying and misleading the court. This is a systemic problem.

I never said we should pretend it's not happening. I'm saying that even bringing that up as a point of comparison with China is silly.

I don't understand how it's relevant to point out that US government actions are illegal. The fact is that it's really happening, so in point of fact, the US is not categorically different from China. The difference, if any, is solely one of degree.

It being illegal is relevant because it is at least considered wrong to do. The degree of difference in what is considered acceptable (and also what is happening) between the two is so staggeringly different it isn't even comparable.

I will continue to disagree, until you can show me that someone is being punished for the illegal actions, and that further steps are being taken to prevent such transgressions in the future.

Today in America it is de facto legal for law enforcement to do this stuff. The fact that a piece of paper somewhere might say otherwise has no bearing on what's actually happening.

> 325 times between 2013 and 2015, cops and employees who misused databases “were fired, suspended or resigned.”

https://www.computerworld.com/article/3124641/cops-run-unaut...

> The act imposes some new limits on the bulk collection of telecommunication metadata on U.S. citizens by American intelligence agencies

https://en.wikipedia.org/wiki/USA_Freedom_Act

And shortly thereafter:

> The National Security Agency (NSA) has formally recommended that the White House drop the phone surveillance program that collects information about millions of US phone calls and text messages. The Wall Street Journal reports that people familiar with the matter say the logistical and legal burdens of maintaining the program outweigh any intelligence benefits it brings.

https://www.engadget.com/2019/04/25/nsa-drop-massive-phone-s...

Sure, the US isn't perfect.

But I'm still very certain that I trust China's approach to data privacy a little less, since they currently do all of the following to happen, without suspicion of a crime:

* mass collection of blood and hair DNA samples for citizens living in minority regions

* literal government occupation of people's homes to take photos and collect information

* installing government cameras inside of peoples homes

* using that information to track, detain, and send ~1 million minorities to re-education camps without being charged or accused of a crime... where they are subjected to forced sterilization and torture.

https://www.hrw.org/news/2018/05/13/china-visiting-officials...

https://www.nytimes.com/2018/09/08/world/asia/china-uighur-m...

https://www.rfa.org/english/news/uyghur/abuse-10302019142433...

The institutional attitudes to privacy are simply not comparable to the US. US authorities are not nonchalant enough about privacy that they think anything close to that that is remotely acceptable in the US.

You do make some good points there, but ultimately I don't buy it. The key thing is your citation of punishments for cops who "misused databases".

This isn't actually what's at issue here. The existence of law enforcement databases is a very different thing than the facility for spying on communications. And I still see no evidence that anyone has been punished for that, or that any active measures have been taken to protect abuses of those programs.

I have never corresponded with a Uighur, and certainly never on topics that are sensitive for the Chinese state. Have you?

I don't see any reason why I would be afforded any more legal protections than they give to their own citizens, do you?

If you're not in their jurisdiction, or neighboring jurisdictions (I've heard some rumors of events in e.g. Vietnam), they're not going to do anything to you. USA cannot make the same claim.

Private information can absolutely be used to coerce/blackmail/extort/compromise/propagandize from abroad. It happens many thousands of times every day.

I wouldn't be surprised if the Chinese state did this and much worse. Governments are evil, film at eleven.

However, if this intercontinental extortion were so common, I suspect we would have heard of a single case by now.

Extortion specifically? How about the Bezos extortion case?

https://www.theguardian.com/world/2020/jan/21/revealed-the-s...

That link seems to refer to the actions of some other nation, which nation is considered by many foolish people to be an ally of USA. But sure, if I were worth twelve figures and I didn't want my wife to find out about my mistress, I would avoid recording my infidelity on electronic devices.

I would assume I am afforded less legal protections than a Chinese citizen!

But here's the thing: with the platonic ideal of "civil liberties" in mind that might bother me, but practically speaking? Chinese legal protections or threats have no bearing on me. None whatsoever.

I don't have a secret clearance. I don't know anyone who does. I don't know anything of significant value to the Chinese state that they couldn't use their existing sources to steal. My "deepest darkest secrets", at worst, would get me in trouble with my local government. They're not enough of a lever to make me an agent of China.

If, however, the information that could get me in trouble with my local government made it to my local government? That might be more of a concern for me.

Do you see why I might not care in the slightest what China knows about me, while simultaneously caring a great deal what my local government knows?

You're only thinking about it in the context of your own personal information, though.

There will also be effects on your peers, neighbors, and society around you. There are nation-state actors currently using stolen data for blackmail, extortion, and propaganda campaigns, to influence the economic and political stability of other nations.

Whether or not you are a direct target, you will be affected in some way. While you feel much more closely connected to your local government, they are not generally acting out of malice.

Even if I believed you - which I absolutely don’t - it’s completely irrelevant.

The intent of my government or of a foreign government has almost zero bearing on my life, for the life of any other average American – someone who does not have a secret clearance, is not committing major felonies, etc.

What matters is material condition, and the ability of that government to project force and change a person’s material condition.

If Chinese intelligence knows who my weed dealer is, or that I on occasion drive my car faster than the posted speed limit, agents of the MSS aren’t going to tail my car and pull me over. If proof that I’m pirating DVDs hits the great firewall I’m not going to get an email threatening me with legal action.

I don’t care if my government really thinks that weed purchases should be illegal or that driving 5 over the speed limit is a societal crisis or that pirating DVDs is a moral wrong: I care that they can project force against me and impact my life.

Sure, if you're not important, the data will not be used against you directly.

I'm sure you can concede that it will, however, be used against organizations, institutions, and people who are important.

Some of those will directly impact your life. This isn't a new idea, the power of both espionage and propaganda are well studied and long established to be effective.

For example:

https://www.nbcnews.com/news/world/russian-documents-reveal-...

Funny you mention that!

https://www.reuters.com/article/us-dea-sod/exclusive-u-s-dir...

At one time, Motorola, Ericsson and Nokia all made GSM/UMTS cellular infrastructure. Are any of them still? Other than Huawei, what other manufacturers are there?

Just cross off Motorola from your list, and there's all of your 5G options as a network provider.

I would probably choose the the opposite. My most likely state-actor adversary would be "my" government so I would prefer to not to make it easier for them to spy on me.

Definitely the Chinese, simply because their foreign policy is much less violent than that of the US, and they don't try to forcefully export their political and economic system to other countries.

Belt and Road Initiative

Opium wars

Not the US

But close:

>Opium profits funded many leading Boston institutions. Thomas Perkins and a brother helped found Massachusetts General Hospital, left, and Perkins donated one of his homes for a new school that ...

https://www.wbur.org/commonhealth/2017/07/31/opium-boston-hi...

Because the fact that China has not engaged in non-local applications of violence, they must be better than the US? That seems to be an amazingly narrow standard, because by that measure any country which carries out atrocities on its own population is 'better' than the US. I understand, even if I may not agree, some individual's dislike of American foreign policy, but to equate America's actions in the last 20 years at a global level with a nation-state which is (according to press reports) imprisoning and potentially torturing and killing those of its own population who meet certain ethnic and demographic criteria seems absent any amount of perspective.

> Because the fact that China has not engaged in non-local applications of violence

Yet.

The PRC has been internationally relevant for a few decades. The US has been internationally relevant practically since its founding.

And for whatever reason, people don't think the PRC has continuity with pre-Mao China -- which has been internationally relevant since long before the US existed, and which doesn't have a very nice track record.

In this regard, this submission could be interesting:

Who Was Sun Tzu’s Napoleon? https://news.ycombinator.com/item?id=22296312

>Millennia later, during the Second World War, Mao Zedong seized on this historical vignette to announce that the Chinese Communist forces would not abide by any political, military, or moral limitations in its fight against the Japanese, stating: “We are not Duke Xiang of Song and have no use for his asinine ethics.”

How about a more realistic scenario instead.

As an American, I choose European / EU 5G equipment in all scenarios over Chinese 5G equipment. I don't care what the cost is.

Europe, broadly (other than Russia primarily), is aligned with the US in all the ways that matter and will continue to be. China is not in almost any regard. The sole things the US and China have in common is trade and that the next century will be defined by persistent US-China superpower tension all around the world and in most all respects.

For most Americans "I don't care what the cost is" immediately makes it an unrealistic scenario. And if history is any indication, for the vast majority of Americans choosing a privacy-focused solution is usually an accident. Price is the determining factor almost always.

The US, I suppose.... The thing with back doors is that others might also find them so it is quite unsafe in any case. Also, the future is unpredictable so who says the US is going to continue to be more-or-less an ally and China is going to continue to not be one?

> so who says the US is going to continue to be more-or-less an ally and China is going to continue to not be one?

Geopolitics is much less unpredictable than "the future." Even the current administration is not so short-sighted to alienate the US to the point of having no powerful allies. If Europe is not considered an ally (it is, not "more or less," it 100% is), where would the US turn? Even if you take a scenario where Trump and Russia are allies, and the US positions itself closer to Russia, Russia's allies are anathema to US interests and ideals, and will be for the foreseeable future.

I just can't see any reality outside of borderline sci-fi where the US is not a close ally to just about every Western European country.

One could ask why the US and european countries are allies. I think it is because both are technologically advanced, both are rich, both are societies with human rights, both are democratic. (Relatively speaking, at least.) These things can change. Now that I name four factors it may sounds like a lot would need to change. But the first two as well as the second two are closely related. And at some point the former two are also related to the latter two. If China wants to keeps developing it will at some point need to improve its human rights situation as well.

The question is insufficiently precise.

Some European agencies want the US government to spy on European citizens because it is illegal for them to do it themselves but it's not illegal for them to obtain information about European citizens from US spies. Whether the European citizens want to be spied on is another matter.

If you're a European citizen or company you might well prefer to be spied on by the Chinese because there's little danger of the Chinese getting you kidnapped/extradited. Also, if your competitors and business contacts are more US than Chinese then the possibility of Chinese commercial espionage is perhaps less worrying than the possibility of US commercial espionage. It seems likely that US agencies sometimes provide information to Boeing to help them compete against Airbus, for example. I'm thinking more of contract negotiations than technological secrets, of course.

Getting equipment from several suppliers seems like the best plan, generally. You can then play them off against each other not just for price but also for openness and forcing the supplier to allow security audits. I've heard that Huawei has been very helpful in that respect, because of the pressure they're under.

>> sometimes provide information to Boeing to help them compete against Airbus, for example.

I've always wondered how that works so that employees dont know about the gov involvement. I suppose they could hire a "consultant", but someone in the company still needs to know dont they?

> Some European agencies want the US government to spy on European citizens because it is illegal for them to do it themselves but it's not illegal for them to obtain information about European citizens from US spies.

Bingo, data sharing agreements between intelligence services.

NSA can't spy on US citizens but GCHQ can, and GCHQ can't spy ok UK citizens but NSA can.

Then just come up with a sharing agreement, and you're "golden".

It's all ridiculous.

Five Eyes sees all

14 eyes see more.

https://restoreprivacy.com/5-eyes-9-eyes-14-eyes/

A choice between two evils... Hmmmm..

A cynic would say America probably already has half a dozen back doors, so what's one more?

There's no point choosing a Chinese back door over an American one if people you talk to are going to entrust your private messages to gmail/ icloud/ aws/ backblaze/ whatsapp.

The answer is simple: do not buy foreign made network technology. That is difficult but the intra European market (if there is trust there) should be big enough for e.g. Ericsson to keep up their Network tech group

Answer from one European individual - USA of course. It doesn't even require a split second of consideration for me.

The major and decisive difference between USA and China is not what they have done, are doing or might do. It is simply that the USA is a democracy and China is not.

In the USA, most of the people in positions of power /have to leave that position/ and /can't do whatever they want/ even when they have it.

That fact alone makes all the difference and is so substantial that it in my mind totally invalidates any whataboutism in this question and any other comparison between the USA and any dictatorship.

Even if a democracy happens to do more evil things in a period of time than a dictatorship, they are the better choice simply because they are a democracy and thus enables the people to both protest and also actually end the evil, through the legal system in the nation. (This does not mean that evil actions are OK when democracies are guilty of them of course, I'm not saying that.)

If and when the day comes that China has had at least two transfers of power to new leaders as a result of internationally observed and validated democratic elections by the people of China, then it would be something to think about. But not as of now.

Based on the premise that I have to choose a spying nation, of course, which I'd rather not do in real life! :)

The US probably does want to reveal the backdoor because its likely they are exploiting it themselves.

If they reveal the backdoor and Huawei closes or replaces it, they'll be locked out

Original source.

Will somebody with access to WSJ please corroborate this quote in OP which is attributed to WSJ?

1 thought for all MNOs and their vulnerability management programs:

Most of your infrastructure has multiple interfaces. Bearer. OAM, Backup, etc.

If your vulnerability scanning program only scans Bearer interfaces, you are fucking up. You can spin up vulnerable services on only one interface. If you don't scan ALL interfaces, you don't know all your entry points.

If you work for an MNO and are reading this, you should take action after reading this content.

Proof or GTFO

Let's see that proof. Then we can talk.

if the US (a tax payer funded operation) has proof it should simply share it, not posture about it.

People will still continue to use Huawei gear unless tangible evidence is presented. The US government has been caught far too many times with its pants down to be trusted.

End to end encryption would be a good fix. Oh wait...

It Would Be Nice(tm) if SS7 was removed from the PSTN... Who needs backdoors into networks when SS7 peers are trusted implicitly.

From yesterday:

How the CIA used Crypto AG encryption devices to spy on countries for decades

https://news.ycombinator.com/item?id=22297963

Wasn’t that Apple “goto fail;” technically a zero-day back door as well?

You had to initiate some specific knock sequence to trigger it.

Did they find something like this in their source code?

I like to post this whenever huawei backdoor gets mentioned.

RDG is the author of masscan

https://blog.erratasec.com/2014/03/we-may-have-witnessed-nsa...

tl;dr they watched someone login with a huawei tech support account from mainland china.

Reminder: US intelligence lies. They are not unique in this but it's worth repeating.

They might be right about Huawei or they might not, either way saying "we totally have proof!" without providing proof is effectively meaningless.

If they had proof they would have showed it already. Nothing would help their rhetoric more than cold hard facts.

If they haven't done it, it means: a) there isn't any backdoor, or b) exposing their backdoors would expose their own backdoors.

I'm betting on b.

c. They have sources saying as such but have not discovered the backdoor itself.

d. Admitting how they found the backdoor would reveal other issues (a source in the pipeline, or their own backdoor in something Huawei made use of).

And probably e-z too.

Yeah exactly - providing proof publicly could in fact burn the sources/methods used to get that proof.

Alternatives:

- Revealing how the backdoor works would show methods the US agencies are also using.

- There are multiple backdoors, or there might be, and they don't want to tip their hand.

"If they had proof they would have showed it already. "

A) They did show 'proof' ostensibly, to the specific agencies of interest i.e. UK/Germany.

B) Your 'a' and 'b' are missing the most important point, in that the revelation of their knowledge may compromise some ongoing intelligence program. The information may very well have been provided by spies who'd be put at risk.

Literally yesterday WaPo published a story on the most comprehensive US intelligence program ever and it quite nicely illustrated the challenges of how to reveal how much you know, and the consequences therein.

This is not 'open source land' where we like complete transparency, it's a different game.

C) There's also another issue, and that this may not be 'black and white'. For example, the ostensible 'back door' may not be clear cut: it may be that it doesn't yet exist, but there are elements in the design prepared for backdoors to be very easily added at a later date.

When was this? Just because in around Nov 2019 a GCHQ spokesman said Chinese backdoors went an issue with UK's dependency on Huawei for 5G (but other risks, network shutdown in times of conflict might be present).

Could you (or anyone) link a source where the NSA, or other USA agencies discuss this with technical detail?

Considering their history of outright lies I'm betting on a).

" saying "we totally have proof!" without providing proof is effectively meaningless."

They've provided ostensible 'proof' to the authorities in Germany and the UK who are the entities they are trying to convince of the issue, which is reasonable.

We'll have to wait to see how the Europeans respond.

The British response has been to still go ahead with using Huawei for potentially over 30% of their non-core infrastructure.

In any case, my point is not that they aren't plausible reasons why they might not make any proof public. My point is that they aren't above using those plausible reasons to propagate disinformation. So their statements are meaningless to us (the public) because it's impossible to discern truth from lies without further information.

> The British response has been to still go ahead with using Huawei for potentially over 30% of their non-core infrastructure.

The British badly need to negotiate pst-Brexit trade deals with all major powers. Pissing off the CCP before the negotiations won’t help the UK’s plans.

Nor will pissing off USA, which presumably is why they timed the issue carefully when any failure in trade will make the biggest mark on the public view of post-Brexit trade potential.

Like 'you know how your mobile phone system works quite well, let us help ruin that for you by messing with it politically', great.

As far as I know Germany also did not exclude Huawei from 5G projects in general. Maybe they have a really good understanding where and where not working with Huawei poses a serious risk, maybe the provided evidence was not convincing, maybe they just don't care.

"that they aren't plausible reasons why they might not make any proof public."

This might be wrong in a couple of ways.

First - without knowing any details, there certainly are many good reasons why the information might not made public, most obviously because it would possibly compromise their methods of acquiring such information. There's a 100% chance that any information they divulged will be acrimoniously parsed by the Chinese to determine the means by which the US obtained the information. The information will likely betray how the Americans are thinking about the problem as well. (Reference yesterday's WaPo article on US/Germany surveillance program and how it was compromised).

Second - there's very limited upside in making the information public, are many downsides. The US, UK, and German agencies don't care about you, or I or any other privacy advocate, or really the knowledge that might arise from a number of public voices piping in. This isn't like open-source SSL software, where it makes sense from a security perspective to be open about it.

Also, I'm doubtful if the 'evidence' the US presented is purely technical in nature. My guess is that this is not a situation of "hey, look at this source code, on like 501, there you go, back door!", it's probably much more complicated. If you read the article, you'll indicate that the US has evidence that China is using its gear to surveil state actors, etc..

Revealing the 'evidence' almost surely involves sensitive information regarding state officials from other countries, insight into US spy programs etc..

If the US is legitimately trying to convince UK/Germany that Huawei gear is a legit threat, then providing them with the necessary information in confidence is obviously the rational thing to do.

UK has problem of ex-parliament being on board of UK division of Huawei. Doubt they'd shoot themselves in the foot and would probably do much in their power to prevent deals not going through.

Who in particular?

Shouldn't moments like this be death blows?

I had totally thought after Apple and Microsoft were caught working on PRISM Americans and corporations would be doing drastic steps to avoid their communication being intercepted.

But for some reason that never happened.

My guess is the proof the Germans were shown was a plan to tax their cars at 40%.

This isn't necessarily about access to the calls themselves. It could be about being about to retrieve network configuration information, call history, maintenance logs, and being able to alter the configuration of the network. The article isn't specific enough.

In other words, do they just want to intercept calls, or steal customer information, or crash the network?

Says the new account with a bunch of digits in the name.

Assume good faith

I'm usually impressed with HN comments, but this thread is currently dominated by insubstantiated conspiratorial mongering against American institutions.

The problem is of those institutions own making. Many Americans lost their lives hunting for Saddam’s WMDs - something that was fabricated by said institutions.

“Trust us” is no longer something we can blindly accept.

To be clear, I was not commenting on skepticism, but on making accusations of lying without evidence.

They started it! Perhaps if they presented some substance people would have more to go on. Do you think anything about USA appears trustable at the moment to those outside?

Reply on news.ycombinator.com