18 ms·

US asks allies to drop Huawei

336 points by petethomas 8y ago

nimbius 8y ago
is there any hard evidence that huawei is a legitimate security concern? Checking the wiki it seems like this is the commerce department trying to piss in the cheerios of a company that doesnt subscribe to the jackboot regimes of US foreign and copyright policy. theyve sold to iran, and have been accused of industrial espionage, but Symantec sold to iran and violated the GPL numerous times without so much as a scolding.
- maccio92 8y ago
  > jackboot regimes of US foreign and copyright policy protecting people's IP is now a "jackboot regime"?
  - ionised 8y ago
    'Protecting people's IP' is an extremely charitable view of US copyright and IP policy.
- JumpCrisscross 8y ago
  > is there any hard evidence that huawei is a legitimate security concern? Yes, quite a bit [1]. Here’s an apolitical example: “In July 2012, Felix Lindner and Gregor Kopf gave a conference at Defcon to announce that they uncovered several critical vulnerabilities in Huawei routers (models AR18 and AR29)which could be used to get remote access to the device. The researchers said that Huawei ‘doesn't have a security contact for reporting vulnerabilities, doesn't put out security advisories and doesn't say what bugs have been fixed in its firmware updates’, and as a result, the vulnerabilities have not been publicly disclosed.” In summary, the best case is Huawei is incompetent. [1] https://en.m.wikipedia.org/wiki/Huawei#Controversies https://en.m.wikipedia.org/wiki/Huawei#Controversies
  - neomax 8y ago
    It's one thing Huawei's products have severe vulnerabilities (as every other IT companies do), and another thing the company is actively engaging in espionage. If this is the best hard evidence the US can bring forward, then the whole allegation sounds entirely political-driven.
    - jchw 8y ago
      If you can't tell, does it matter? If you're hoping for espionage to be obvious and blatant, I think you must be underestimating people's creativity.
      - jake_the_third 8y ago
        Then we shouldn't deal with Cisco, Juniper, and pretty much every other network equipment manufacturer. What kind of logic is that?
        jchw 8y ago
        Trust is not binary.
        jake_the_third 8y ago
        I fail to see how this ties into your original point.
        adventured 8y ago
        It's this kind of logic: it depends on whether you believe the US is as big of a security or IP-theft threat to you as China is. Your premise relies on the US == China. If that isn't the case, your premise collapses in one form or another. Taiwan, Japan and South Korea aren't afraid of the US. They are afraid of China. Finland, Romania, Poland, Ukraine and Estonia aren't afraid the US will invade and annex their territory. They are afraid of Russia's territorial ambitions in Eastern Europe. For example, how do you think Australia feels about it right now? "China’s peak security agency has directed a surge in cyber attacks on Australian companies over the past year, breaching an agreement struck between Premier Li Keqiang and former Prime Minister Malcolm Turnbull to not steal each other’s commercial secrets." https://www.smh.com.au/business/companies/china-uses-the-cloud-to-step-up-spying-on-australian-business-20181119-p50gze.html https://www.smh.com.au/business/companies/china-uses-the-clo... "China reportedly steps up efforts to steal Australian company secrets" https://www.cnbc.com/2018/11/21/cybersecurity-china-reportedly-increased-attacks-on-australian-firms.html https://www.cnbc.com/2018/11/21/cybersecurity-china-reported...
- neomax 8y ago
  There is none in recent years. Huawei even offered to open its complete source code to the US government for inspection but got turned down. There is evidence that the US spy agency hacked in Huawei HQ for years and still the US cannot produce evidence of Huawei wrongdoing. But then again it's possible the US don't want to disclose it's intel source.
- dnomad 8y ago
  No, there's absolutely no evidence that Huawei equipment is a legitmate security concern. In fact it's just the opposite. Huawei equipment has been extensively and continuously studied by the best security researchers in the world. Britain, alone, spent roughly $25 million dollars going over all Huawei equipment with a fine tooth comb and their "big conclusion" was that they can only offer "limited assurances" of Huawei equipment [1]. USA and France and Germany and Brazil have also extensively analyzed Huawei equipment and come up with nothing. Ironically, as the discussion in India and Japan and the Phillipines now show, the Western obsession with Huawei and has only made the case for Huawei's equipment much, much stronger. [1] https://www.reuters.com/article/us-huawei-security-britain-exclusive/exclusive-britain-says-huawei-shortcomings-expose-new-telecom-networks-risks-idUSKBN1K92BX https://www.reuters.com/article/us-huawei-security-britain-e...
- jake_the_third 8y ago
  > is there any hard evidence that huawei is a legitimate security concern? As someone with a lot of huawei in their infrastructure, this is what I really want to know as well. The US government has lost a lot of credibility over the last few decades with its lopsided foreign policies that completely tip towards self-serving and agenda-pushing rather than decency and public good. There is nothing indicating that this particular issue is any different. Unless the US government shows hard evidence that the company is harming us, we're not ditching them. Innocent until proven guilty applies to entities you don't like too.
  - e3b0c 8y ago
    The difference is when the US government does something nasty, it's relatively transparent and accountable. It is not the case for the China government.
    - jake_the_third 8y ago
      From where I'm sitting, both are not transparent and accountable.
      - e3b0c 8y ago
        Both Chinese and Americans can protest about the US government's scandals on an internet forum hosted on the US, not the other way around though.
        RidingPegasus 8y ago
        Do you actually have any firsthand experience with Chinese internet culture? There's plenty of discontent and protestation about government policy, it's everywhere.
    - HillaryBriss 8y ago
      ... in other words, information about the nastiness is leaked
    - deleted 8y ago
dbcooper 8y ago
There is a dispute in NZ between telcos and the government over Huawei at the moment. https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=12165136 https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&... https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=12153225 https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&...
anilshanbhag 8y ago
A key difference between Huawei and other Chinese companies like Xiaomi or Alibaba is that they have an opaque shareholding structure with no public investors which makes it hard to know if it is free from the influence of the Chinese government.
- taneq 8y ago
  If a company operates in China then it's under the influence of the Chinese government.
  - beefsack 8y ago
    To be fair, you can say any company operating in a specific country works under the influence of that government. Many US companies run or ran warrant canaries for this specific reason.
    - taneq 8y ago
      Absolutely, if you're concerned about interest/influence from foreign nations you need to consider the country of origin of, well, everything.
    - JumpCrisscross 8y ago
      > you can say any company operating in a specific country works under the influence of that government This collapses the continuum of the rule of law into a false binary. Americans and foreigners alike can successfully challenge the U.S. government in independent courts. None of those elements exist in China.
      - jimjimjim 8y ago
        what is it with people these days having a desire to reduce everything in the world to a binary yes/no, true/false, is/isn't situation?
      - endorphone 8y ago
        How is the FISA court independent? The US government can strong-arm corporate partners to do virtually anything they want, and can not only threaten jail if you ever talk about it, they cloak the whole thing -- even for the most banal thing -- as classified so it's impossible to contest. This seems like pretending there is nuance that there simply isn't. The system is a charade around the reality that US intelligence has virtually identical inroads to US corporations.
saagarjha 8y ago
> Some other members of the “Five Eyes,” a five-member intelligence pact among English-speaking countries that includes the U.S., have also publicly challenged Huawei. Regardless of the content of the article, I found this quote hilarious: one surveillance agency accusing another group of spying.
- ObsoleteNerd 8y ago
  Do as we say, not as we do.
  - ehsankia 8y ago
    How dare they meddle in our election, said the country who has meddled in hundreds of elections and set up countless coups.
    - zabana 8y ago
      Western arrogance and hypocrisy in all its glory.
- beloch 8y ago
  I remain to be convinced that Apple or Samsung are any more trustworthy than Huawei. It's all made in China. While these manufacturers may not be sneaking backdoors into devices, since this might be caught, they likely are being compelled to disclose designs to be analyzed for weaknesses. It doesn't really matter if some of the design work is done in California. I wouldn't have substantially higher trust in something made in the U.S. or other "five eyes" countries either. These governments do not respect the privacy of their citizens, as evidenced by the NSA's recent breaches. Some countries do slightly better than others (e.g. Canada probably isn't as bad as the U.S. yet). However, on the whole, privacy rights seem to be on the decline in these countries. Treaties and cooperation between the security agencies of these countries drag everyone down to the lowest common denominator.
  - friedman23 8y ago
ajdlinux 8y ago
The Director-General of ASD vs a Huawei employee on Twitter today: https://twitter.com/MikePBurgess/status/1065375012125761536 https://twitter.com/MikePBurgess/status/1065375012125761536
- socceroos 8y ago
  Yeah, ASD haven't got the best relationship with Huawei. For years they've been in the PM's ear about keeping clear of them for NBN infrastructure. To be honest, no manufacturer can be truly trusted, but given the vastly different political and social ideologies between China and the West it seems reasonable that they're picking their poison.
nradov 8y ago
Huawei has been spending a lot more advertising their consumer electronics in the USA lately. Probably trying to build some goodwill.
TACIXAT 8y ago
I don't see anyone else talking about it. Around January 2018 it came out that China had hacked the African Union headquarters which it had built as a gift to the AU. [1] More recently, reports have come out that implicate Huawei in that hack. [2] There is a law in China that says citizens and corporations are required to cooperate with its intelligence services. While there has been no strong evidence against Huawei released publicly, the logic is that China asked for a backdoor and that Huawei had to comply. >Ms Cave said Huawei had been implicated in alleged cyber theft of data from the African Union’s Ethiopia headquarters. According to multiple reports this year, data was transferred every night from the building for five years. “There’s no proof that Huawei was asked to participate or turn a blind eye to the breach, but we know that there was a breach and Huawei was the key provider,’’ Ms Cave said. 1. https://www.theguardian.com/world/2018/jan/30/china-african-union-headquarters-bugging-spying https://www.theguardian.com/world/2018/jan/30/china-african-... 2. https://www.theaustralian.com.au/national-affairs/national-security/china-used-huawei-to-hack-network-says-secret-report/news-story/510d3b17c2791cbcac18f047c64ab9d8 https://www.theaustralian.com.au/national-affairs/national-s...
- endorphone 8y ago
  There is a law in China that says citizens and corporations are required to cooperate with its intelligence services Of course US corporations are just as beholden to government directive. e.g. https://foreignpolicy.com/2016/10/04/how-american-companies-enable-nsa-surveillance/ https://foreignpolicy.com/2016/10/04/how-american-companies-...
  - friedman23 8y ago
    The alternative to Huawei for telecommunications equipment isn't a US corporation so framing it as the US vs China serves no purpose. I'll be happy if neither the US nor China made telecommunications equipment for countries. I don't understand why people feel the need to defend Chinese mega corporations. edit: I managed to offend a few people with this comment
    - jake_the_third 8y ago
majia 8y ago
The US government, with its own hacking of other countries as revealed by Snowden, its strategic rivalry with China, and its history of false intelligence such as WMD in Iraq, isn’t a trustworthy source to evaluate Huawei’s security. Huawei has completely opened its source code and hardware to several governments, including UK, Canada and Germany, for security testing. Their findings are much more informative and objective. Best security doesn’t come from paranoia of certain countries. It comes from evidence based and rigorous testing and research.
- yitosda 8y ago
  > Huawei has completely opened its source code and hardware to several governments, including UK, Canada and Germany, for security testing. Their findings are much more informative and objective. What does this even mean? If I give a batch of governments some of my super secret text files and pinky promise that's what's in the hardware I'm giving them, they should believe me? The US can be trusted to advance its own interests. So can China. Everyone else had best evaluate their threat vectors and find out where their interests conflict with bigger and stronger interests. Your comment history might have predicted that you'd comment on this topic. You don't have many other interests.
  - StudentStuff 8y ago
    To add to this, what is described is called Shared Source, not Open Source or Libre Software. Microsoft does shared source with numerous governments and universities, but your placing complete trust in the vendor that the code they show you is what is in their distributed binaries, esp. with how many compilers output different binaries when recompiled with the same code. The only way to even start considering any of the current telecom vendors (including Huawei, NSN, etc) as not malicious is to have them offer their code under a libre license that bars tivoization, otherwise there is no guarantee that you can load the firmware they gave you the source to onto the LTE base stations sold your company.
  - majia 8y ago
    The testing centers have more sophisticated methods to address your concern. They procure Huawei equipment from various vendors and check if they have the same hardware and software. In fact, the recent report from UK did find minor shortcomings related to binary mismatch in huawei products. My point is not testing centers can provide 100% guarantee; such guarantee does not exist in the security field. However, shared hardware and rigorous testing provide far better security than blind trust and paranoia. Also, what's wrong with being interested in sino-US technological relationship?
throwaway487548 8y ago
Where Huawei got the IP? From Nortel? How much royalty fees it paid? None? That is why.
newnewpdro 8y ago
Implicitly manufacturing American confidence in domestic brands with such headlines while economically harming China, this obviously doesn't need to have a shred of evidence to be worthwhile. But don't forget all smartphones are pwned.
- friedman23 8y ago
  >But don't forget all smartphones are pwned. This is the safest assumption
  - matt4077 8y ago
    Sure, in the way that assuming all food is rotten is the only way to completely avoid food poisoning. If, however, you don't subscribe to the starving lifestyle, such blanket assumption are useless. Same for phones: do you just not use a phone? Does the poster above you rely on the heuristic that people using the term "pwned" generally don't have much of relevance to say anyway? Because if everything is terrible, and everyone is corrupt, and there is absolutely no use in considering the probability that some options are less terrible than others, and that there may be signs the public can pick up on to make decisions, then congratulations: those believes do help in feeling really smug about your cynicism. But they don't really help otherwise.
    - balibebas 8y ago
      Without NetGuard or similar all smartphones, everywhere, are indeed pwnd. The mistake made in using a food analogy is that, while both are consumables (consuming attention in the case of a phone) only one is a necessity to life.
- MichaelMoser123 8y ago
  the article mentions concerns over telco equipment; so it seems to be about their routers, not the phones. I wonder if they will spin off the phone business, as it seems to be turning into 'collateral damage', at least in Nato countries, that is. (disclaimer: bought Huawei phones for my kids - pretty good phones at reasonable prices)
friedman23 8y ago
I find it interesting that nobody arguing in favor of Huawei attempts to dispute the fact that data transmitted over Huawei hardware is insecure.
- rubatuga 8y ago
  That would mean knowing the intricacies of Huawei source code, which would imply that they are a shill
client4 8y ago
I haven't seen much about the 'hacks' taking place. Are investigators seeing actual backdoors? Or just poor code being exploited in the wild? If it's the latter then the US could be accused of the same with Cisco in the early 2000's as exposed by FX.
- unmole 8y ago
  Full disclosure: I am a Huawei employee, take everthing I say with an appropriate amount of salt. It would be suicidal for Huawei to ship any eqipment to Western carriers with actual backdoors. European governments usually require through audit of the code that runs their networks and vendors are required to have reproducable builds for the same. The UK government for instance has the Huawei Cyber Security Evaluation Centre[1] responsible for vetting the Huawei equipment that gets used by British carriers. Like TFA says, "The U.K. government said in July it found shortcomings in the process." They did't find any backdoors or any actual vunerebilities but did report "variable engineering quality". Like any large and complex codebase produced by thousands of engineers, parts of the code may be downright ugly but that does not make it malicious. Anyways, the CSEC report did have its intended effect and now significant resources are being expended to refactor legacy code. Nothing motivates management like a possible loss of revenue from bad PR ;) Then again the NSA hacked into Huawei HQ[2] so they might know something that others don't. Speaking of which, how is the search for WMDs in Iraq coming along? 1: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/626110/20170413_HCSEC_Oversight_Board_Report_2017_-_FINAL.pdf https://assets.publishing.service.gov.uk/government/uploads/... 2: https://www.nytimes.com/2014/03/23/world/asia/nsa-breached-chinese-servers-seen-as-spy-peril.html https://www.nytimes.com/2014/03/23/world/asia/nsa-breached-c...
  - le_clochard 8y ago
    This is not the first time. Huawei was banned from supplying for India's National Broadband Network in 2012, and has again been banned from supplying for India's 5G revamp. Not all employees would be in on the espionage attempts either. It'd have to be a very limited circle that knows about it.
unixhero 8y ago
Welp. It's fairly ubiquitous.
ojbyrne 8y ago
Pretty hard argument to make after the US decided Canadian steel is a threat to national security.
- lamarpye 8y ago
  Maybe if you treat "Canada as a national security treat" as a posture during trade negotiations, it might not be such a hard argument.
vorticalbox 8y ago
Next they will be calling to ban all toy imports in case they continue microphones.
- rexpop 8y ago
  A classic Phildickian premise; see his 1959 story "War Game."
oger 8y ago
Pick your poison.
moretosee 8y ago
I think Germany will definitely refuse the propose as Merkel's phone was tapped by US. https://www.telegraph.co.uk/news/worldnews/europe/germany/10407282/Barack-Obama-approved-tapping-Angela-Merkels-phone-3-years-ago.html https://www.telegraph.co.uk/news/worldnews/europe/germany/10...
tjpnz 8y ago
I would've expected better from the current NZ government but this response really illustrates just how utterly compromised the country is when it comes to China. There was a similar muted response a few months ago to Chinese CCTV cameras which had been installed inside government ministries.
- pilsetnieks 8y ago
  At least those you can quarantine on a network level; it's much harder (or really impossible) when it's networking equipment that's suspect.
balibebas 8y ago
Little known fact: The stock video app in EMUI 8 running found in stock P20 Pros from authorized dealers in Singapore regularly make requests to Facebook over over IPv4 and IPv6 even though it only supports local video content. t.me/paranoic for proofs.
- balibebas 8y ago
  To be fair, Google regularly tries to grab GPS data using its 1e100.net domain (see above # for additional proofs). The only way I've found to block this kind of intrusion is NetGuard in "lockdown" mode.
danmaz74 8y ago
I had understood that the current US administration's point of view was that the US had no allies, but only leeches hell bent on ripping off the US? So, I'm wondering which allies they're talking to.
- ThomPete 8y ago
  That the wrong understanding.
stanulilic 8y ago
Good move.
kushti 8y ago
American regime is truly terrible. I boycott all the American for years, and wonder how many people are doing the same in 2018.
TsomArp 8y ago
I don't get it. Isn't everything or almost everything being built in china nowadays? If you don't trust them, build in house.
londons_explore 8y ago
When will people learn - 'secure the connections, not the network'. You don't trust the internet, and you shouldn't trust your internal network either. Every connection between devices should be encrypted as if it's going over the internet. That's the basis of BeyondCorp, and many companies are going that way. It's far more sensible to secure just two endpoints than it is to also secure all the wireless links, routers, and cables between them. Now, when the adversary gets control of your routers, it doesn't matter - they can't steal anything of value. The worst they can do is cause a brief outage, for which they'll be immediately detected.
- libdjml 8y ago
  Sure, that’s a great idea. But your transport security is going to show vulnerability sooner or later (see: regular issues in TLS), and it’s worth having a slightly less compromised network fabric. I agree with your general sentiment though.
- shawn 8y ago
  This is mistaken. If an adversary has control of your routers, they have a way to pivot into your computers. I used to do this for a living.
- aembleton 8y ago
  But they can slow down the traffic or disconnect it completely. If an entire countries 5G infrastructure is built by a single company that can push updates to the infrastructure, then it can completely disable it.
levosmetalo 8y ago
This implies that US can't reach the data from Huawei. So it seems that Huawei is the safest option for any US and European citizen. I'd rather have my data safe with the Chinese government, a country that is on the other side of the globe and has practically zero influence on my life, that sharing it with the US or my own governments, which are there, and can make my life hell for any or no reason at all, and have the means to actually hurt me. And yes, if I can't avoid it, I'd much rather share my internet search history with an unknown entity on the other side of the world, than with my own wife.
- Gorbzel 8y ago
  This might be the stupidest rationalization ever posted on HN.
  - tylerl 8y ago
    ...which is saying something.
- detaro 8y ago
  In the Snowden leaks there was a bunch of evidence that US intelligence at least had deep access to Huawei: https://mashable.com/2014/03/22/nsa-huawei/ https://mashable.com/2014/03/22/nsa-huawei/
  - SwellJoe 8y ago
    A system with a backdoor is a system exploitable by a high capability attacker, like most major state intelligence agencies.
    - Jyaif 8y ago
      Not if the output of the backdoor is encrypted.
      - Retric 8y ago
deleted 8y ago
[deleted]
vectorEQ 8y ago
haha good luck , whole countries networks / isp networks get managed by them. sure US will cover for those costs of changing with their fiat currency.
- toxik 8y ago
  Other telecom actors were steamrolled by the government-backed Huawei telecom network deals. Ericsson for example could not keep up because the EU doesn't believe in protectionism, at least at that level.
cbzbc 8y ago
Within the UK Huawei has won a number of network refresh contracts with BT. I assume this then got levels of concern going within the various agencies, as this was one of the results: https://www.gov.uk/government/publications/huawei-cyber-security-evaluation-centre-oversight-board-annual-report-2015 https://www.gov.uk/government/publications/huawei-cyber-secu... A factory within the UK, owned by Huawei's UK arm - with restrictions entry, that is then used for security assurance of the products BT uses.
johannkokos 8y ago
No one talks about the story from financial perspective? How much will Huawei lose, who is the competitor against Huawei? IMO it's the extension of trade war between US and China.
Bizarro 8y ago
China does something bad. Whataboutism. Rinse, Repeat. Nobody's mind is changed, even though everybody thinks they're going to make some great argument. What a waste of keystrokes.
Havoc 8y ago
In other news - my Huawei tablet arrived today & this was one of the first articles I read on it oh the irony
throw2016 8y ago
There are too many double standards here, about capitalism, free trade, technological progress. There is a legitimate reason to be concerned about backdoors and spyware, but why should this 'concern' be limited to a single country in this self serving way? What this really says is that some companies and countries can access all markets without concerns but when others try to grow their market access will be restricted with scaremongering, bullying and political games perpetuating an artificial marketplace. Its the ideologues who always argue on 'free markets' and 'competition' in absolute terms who should wake up to how little the real world has to do with their idealized constructs.
simonblack 8y ago
Protection for US 5G Corporations to allow them to catch up. Then there's the other side of the coin. The Chinese boycotting of US Corporations. China alone has more population and manufacturing than the US and EU combined. Does the West really want to lose a market that's 20% of the whole world? Probably not. "Trade Wars are good and easy to win." /s
lyrachord 8y ago
I wonder why so many fake mans believes fake news. The saying is: Don't be evil, otherwise devoured by the devil.
StefanKarpinski 8y ago
There's also substantial evidence that Huawei was involved in the murder of a US citizen to cover up attempts to acquire classified US military technology: https://en.wikipedia.org/wiki/Death_of_Shane_Todd https://en.wikipedia.org/wiki/Death_of_Shane_Todd Financial Times story about the case: http://ig-legacy.ft.com/content/afbddb44-7640-11e2-8eb6-00144feabdc0 http://ig-legacy.ft.com/content/afbddb44-7640-11e2-8eb6-0014... Discussion on HN: https://news.ycombinator.com/item?id=5230585 https://news.ycombinator.com/item?id=5230585
deleted 8y ago
[deleted]

336 points by petethomas 8y ago

is there any hard evidence that huawei is a legitimate security concern? Checking the wiki it seems like this is the commerce department trying to piss in the cheerios of a company that doesnt subscribe to the jackboot regimes of US foreign and copyright policy. theyve sold to iran, and have been accused of industrial espionage, but Symantec sold to iran and violated the GPL numerous times without so much as a scolding.

maccio92 8y ago
> jackboot regimes of US foreign and copyright policy protecting people's IP is now a "jackboot regime"?
- ionised 8y ago
  'Protecting people's IP' is an extremely charitable view of US copyright and IP policy.
JumpCrisscross 8y ago
> is there any hard evidence that huawei is a legitimate security concern? Yes, quite a bit [1]. Here’s an apolitical example: “In July 2012, Felix Lindner and Gregor Kopf gave a conference at Defcon to announce that they uncovered several critical vulnerabilities in Huawei routers (models AR18 and AR29)which could be used to get remote access to the device. The researchers said that Huawei ‘doesn't have a security contact for reporting vulnerabilities, doesn't put out security advisories and doesn't say what bugs have been fixed in its firmware updates’, and as a result, the vulnerabilities have not been publicly disclosed.” In summary, the best case is Huawei is incompetent. [1] https://en.m.wikipedia.org/wiki/Huawei#Controversies https://en.m.wikipedia.org/wiki/Huawei#Controversies
- neomax 8y ago
  It's one thing Huawei's products have severe vulnerabilities (as every other IT companies do), and another thing the company is actively engaging in espionage. If this is the best hard evidence the US can bring forward, then the whole allegation sounds entirely political-driven.
  - jchw 8y ago
    If you can't tell, does it matter? If you're hoping for espionage to be obvious and blatant, I think you must be underestimating people's creativity.
    - jake_the_third 8y ago
      Then we shouldn't deal with Cisco, Juniper, and pretty much every other network equipment manufacturer. What kind of logic is that?
      - jchw 8y ago
        Trust is not binary.
        jake_the_third 8y ago
        I fail to see how this ties into your original point.
      - adventured 8y ago
        It's this kind of logic: it depends on whether you believe the US is as big of a security or IP-theft threat to you as China is. Your premise relies on the US == China. If that isn't the case, your premise collapses in one form or another. Taiwan, Japan and South Korea aren't afraid of the US. They are afraid of China. Finland, Romania, Poland, Ukraine and Estonia aren't afraid the US will invade and annex their territory. They are afraid of Russia's territorial ambitions in Eastern Europe. For example, how do you think Australia feels about it right now? "China’s peak security agency has directed a surge in cyber attacks on Australian companies over the past year, breaching an agreement struck between Premier Li Keqiang and former Prime Minister Malcolm Turnbull to not steal each other’s commercial secrets." https://www.smh.com.au/business/companies/china-uses-the-cloud-to-step-up-spying-on-australian-business-20181119-p50gze.html https://www.smh.com.au/business/companies/china-uses-the-clo... "China reportedly steps up efforts to steal Australian company secrets" https://www.cnbc.com/2018/11/21/cybersecurity-china-reportedly-increased-attacks-on-australian-firms.html https://www.cnbc.com/2018/11/21/cybersecurity-china-reported...
neomax 8y ago
There is none in recent years. Huawei even offered to open its complete source code to the US government for inspection but got turned down. There is evidence that the US spy agency hacked in Huawei HQ for years and still the US cannot produce evidence of Huawei wrongdoing. But then again it's possible the US don't want to disclose it's intel source.
dnomad 8y ago
No, there's absolutely no evidence that Huawei equipment is a legitmate security concern. In fact it's just the opposite. Huawei equipment has been extensively and continuously studied by the best security researchers in the world. Britain, alone, spent roughly $25 million dollars going over all Huawei equipment with a fine tooth comb and their "big conclusion" was that they can only offer "limited assurances" of Huawei equipment [1]. USA and France and Germany and Brazil have also extensively analyzed Huawei equipment and come up with nothing. Ironically, as the discussion in India and Japan and the Phillipines now show, the Western obsession with Huawei and has only made the case for Huawei's equipment much, much stronger. [1] https://www.reuters.com/article/us-huawei-security-britain-exclusive/exclusive-britain-says-huawei-shortcomings-expose-new-telecom-networks-risks-idUSKBN1K92BX https://www.reuters.com/article/us-huawei-security-britain-e...
jake_the_third 8y ago
> is there any hard evidence that huawei is a legitimate security concern? As someone with a lot of huawei in their infrastructure, this is what I really want to know as well. The US government has lost a lot of credibility over the last few decades with its lopsided foreign policies that completely tip towards self-serving and agenda-pushing rather than decency and public good. There is nothing indicating that this particular issue is any different. Unless the US government shows hard evidence that the company is harming us, we're not ditching them. Innocent until proven guilty applies to entities you don't like too.
- e3b0c 8y ago
  The difference is when the US government does something nasty, it's relatively transparent and accountable. It is not the case for the China government.
  - jake_the_third 8y ago
    From where I'm sitting, both are not transparent and accountable.
    - e3b0c 8y ago
      Both Chinese and Americans can protest about the US government's scandals on an internet forum hosted on the US, not the other way around though.
      - RidingPegasus 8y ago
        Do you actually have any firsthand experience with Chinese internet culture? There's plenty of discontent and protestation about government policy, it's everywhere.
  - HillaryBriss 8y ago
    ... in other words, information about the nastiness is leaked
  - deleted 8y ago

dbcooper 8y ago

There is a dispute in NZ between telcos and the government over Huawei at the moment. https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=12165136 https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&... https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=12153225 https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&...

anilshanbhag 8y ago

A key difference between Huawei and other Chinese companies like Xiaomi or Alibaba is that they have an opaque shareholding structure with no public investors which makes it hard to know if it is free from the influence of the Chinese government.

taneq 8y ago
If a company operates in China then it's under the influence of the Chinese government.
- beefsack 8y ago
  To be fair, you can say any company operating in a specific country works under the influence of that government. Many US companies run or ran warrant canaries for this specific reason.
  - taneq 8y ago
    Absolutely, if you're concerned about interest/influence from foreign nations you need to consider the country of origin of, well, everything.
  - JumpCrisscross 8y ago
    > you can say any company operating in a specific country works under the influence of that government This collapses the continuum of the rule of law into a false binary. Americans and foreigners alike can successfully challenge the U.S. government in independent courts. None of those elements exist in China.
    - jimjimjim 8y ago
      what is it with people these days having a desire to reduce everything in the world to a binary yes/no, true/false, is/isn't situation?
    - endorphone 8y ago
      How is the FISA court independent? The US government can strong-arm corporate partners to do virtually anything they want, and can not only threaten jail if you ever talk about it, they cloak the whole thing -- even for the most banal thing -- as classified so it's impossible to contest. This seems like pretending there is nuance that there simply isn't. The system is a charade around the reality that US intelligence has virtually identical inroads to US corporations.

saagarjha 8y ago

> Some other members of the “Five Eyes,” a five-member intelligence pact among English-speaking countries that includes the U.S., have also publicly challenged Huawei. Regardless of the content of the article, I found this quote hilarious: one surveillance agency accusing another group of spying.

ObsoleteNerd 8y ago
Do as we say, not as we do.
- ehsankia 8y ago
  How dare they meddle in our election, said the country who has meddled in hundreds of elections and set up countless coups.
  - zabana 8y ago
    Western arrogance and hypocrisy in all its glory.
beloch 8y ago
I remain to be convinced that Apple or Samsung are any more trustworthy than Huawei. It's all made in China. While these manufacturers may not be sneaking backdoors into devices, since this might be caught, they likely are being compelled to disclose designs to be analyzed for weaknesses. It doesn't really matter if some of the design work is done in California. I wouldn't have substantially higher trust in something made in the U.S. or other "five eyes" countries either. These governments do not respect the privacy of their citizens, as evidenced by the NSA's recent breaches. Some countries do slightly better than others (e.g. Canada probably isn't as bad as the U.S. yet). However, on the whole, privacy rights seem to be on the decline in these countries. Treaties and cooperation between the security agencies of these countries drag everyone down to the lowest common denominator.
- friedman23 8y ago

ajdlinux 8y ago

The Director-General of ASD vs a Huawei employee on Twitter today: https://twitter.com/MikePBurgess/status/1065375012125761536 https://twitter.com/MikePBurgess/status/1065375012125761536

socceroos 8y ago
Yeah, ASD haven't got the best relationship with Huawei. For years they've been in the PM's ear about keeping clear of them for NBN infrastructure. To be honest, no manufacturer can be truly trusted, but given the vastly different political and social ideologies between China and the West it seems reasonable that they're picking their poison.

nradov 8y ago

Huawei has been spending a lot more advertising their consumer electronics in the USA lately. Probably trying to build some goodwill.

TACIXAT 8y ago

I don't see anyone else talking about it. Around January 2018 it came out that China had hacked the African Union headquarters which it had built as a gift to the AU. [1] More recently, reports have come out that implicate Huawei in that hack. [2] There is a law in China that says citizens and corporations are required to cooperate with its intelligence services. While there has been no strong evidence against Huawei released publicly, the logic is that China asked for a backdoor and that Huawei had to comply. >Ms Cave said Huawei had been implicated in alleged cyber theft of data from the African Union’s Ethiopia headquarters. According to multiple reports this year, data was transferred every night from the building for five years. “There’s no proof that Huawei was asked to participate or turn a blind eye to the breach, but we know that there was a breach and Huawei was the key provider,’’ Ms Cave said. 1. https://www.theguardian.com/world/2018/jan/30/china-african-union-headquarters-bugging-spying https://www.theguardian.com/world/2018/jan/30/china-african-... 2. https://www.theaustralian.com.au/national-affairs/national-security/china-used-huawei-to-hack-network-says-secret-report/news-story/510d3b17c2791cbcac18f047c64ab9d8 https://www.theaustralian.com.au/national-affairs/national-s...

endorphone 8y ago
There is a law in China that says citizens and corporations are required to cooperate with its intelligence services Of course US corporations are just as beholden to government directive. e.g. https://foreignpolicy.com/2016/10/04/how-american-companies-enable-nsa-surveillance/ https://foreignpolicy.com/2016/10/04/how-american-companies-...
- friedman23 8y ago
  The alternative to Huawei for telecommunications equipment isn't a US corporation so framing it as the US vs China serves no purpose. I'll be happy if neither the US nor China made telecommunications equipment for countries. I don't understand why people feel the need to defend Chinese mega corporations. edit: I managed to offend a few people with this comment
  - jake_the_third 8y ago

majia 8y ago

The US government, with its own hacking of other countries as revealed by Snowden, its strategic rivalry with China, and its history of false intelligence such as WMD in Iraq, isn’t a trustworthy source to evaluate Huawei’s security. Huawei has completely opened its source code and hardware to several governments, including UK, Canada and Germany, for security testing. Their findings are much more informative and objective. Best security doesn’t come from paranoia of certain countries. It comes from evidence based and rigorous testing and research.

yitosda 8y ago
> Huawei has completely opened its source code and hardware to several governments, including UK, Canada and Germany, for security testing. Their findings are much more informative and objective. What does this even mean? If I give a batch of governments some of my super secret text files and pinky promise that's what's in the hardware I'm giving them, they should believe me? The US can be trusted to advance its own interests. So can China. Everyone else had best evaluate their threat vectors and find out where their interests conflict with bigger and stronger interests. Your comment history might have predicted that you'd comment on this topic. You don't have many other interests.
- StudentStuff 8y ago
  To add to this, what is described is called Shared Source, not Open Source or Libre Software. Microsoft does shared source with numerous governments and universities, but your placing complete trust in the vendor that the code they show you is what is in their distributed binaries, esp. with how many compilers output different binaries when recompiled with the same code. The only way to even start considering any of the current telecom vendors (including Huawei, NSN, etc) as not malicious is to have them offer their code under a libre license that bars tivoization, otherwise there is no guarantee that you can load the firmware they gave you the source to onto the LTE base stations sold your company.
- majia 8y ago
  The testing centers have more sophisticated methods to address your concern. They procure Huawei equipment from various vendors and check if they have the same hardware and software. In fact, the recent report from UK did find minor shortcomings related to binary mismatch in huawei products. My point is not testing centers can provide 100% guarantee; such guarantee does not exist in the security field. However, shared hardware and rigorous testing provide far better security than blind trust and paranoia. Also, what's wrong with being interested in sino-US technological relationship?

throwaway487548 8y ago

Where Huawei got the IP? From Nortel? How much royalty fees it paid? None? That is why.

newnewpdro 8y ago

Implicitly manufacturing American confidence in domestic brands with such headlines while economically harming China, this obviously doesn't need to have a shred of evidence to be worthwhile. But don't forget all smartphones are pwned.

friedman23 8y ago
>But don't forget all smartphones are pwned. This is the safest assumption
- matt4077 8y ago
  Sure, in the way that assuming all food is rotten is the only way to completely avoid food poisoning. If, however, you don't subscribe to the starving lifestyle, such blanket assumption are useless. Same for phones: do you just not use a phone? Does the poster above you rely on the heuristic that people using the term "pwned" generally don't have much of relevance to say anyway? Because if everything is terrible, and everyone is corrupt, and there is absolutely no use in considering the probability that some options are less terrible than others, and that there may be signs the public can pick up on to make decisions, then congratulations: those believes do help in feeling really smug about your cynicism. But they don't really help otherwise.
  - balibebas 8y ago
    Without NetGuard or similar all smartphones, everywhere, are indeed pwnd. The mistake made in using a food analogy is that, while both are consumables (consuming attention in the case of a phone) only one is a necessity to life.
MichaelMoser123 8y ago
the article mentions concerns over telco equipment; so it seems to be about their routers, not the phones. I wonder if they will spin off the phone business, as it seems to be turning into 'collateral damage', at least in Nato countries, that is. (disclaimer: bought Huawei phones for my kids - pretty good phones at reasonable prices)

friedman23 8y ago

I find it interesting that nobody arguing in favor of Huawei attempts to dispute the fact that data transmitted over Huawei hardware is insecure.

rubatuga 8y ago
That would mean knowing the intricacies of Huawei source code, which would imply that they are a shill

client4 8y ago

I haven't seen much about the 'hacks' taking place. Are investigators seeing actual backdoors? Or just poor code being exploited in the wild? If it's the latter then the US could be accused of the same with Cisco in the early 2000's as exposed by FX.

unmole 8y ago
Full disclosure: I am a Huawei employee, take everthing I say with an appropriate amount of salt. It would be suicidal for Huawei to ship any eqipment to Western carriers with actual backdoors. European governments usually require through audit of the code that runs their networks and vendors are required to have reproducable builds for the same. The UK government for instance has the Huawei Cyber Security Evaluation Centre[1] responsible for vetting the Huawei equipment that gets used by British carriers. Like TFA says, "The U.K. government said in July it found shortcomings in the process." They did't find any backdoors or any actual vunerebilities but did report "variable engineering quality". Like any large and complex codebase produced by thousands of engineers, parts of the code may be downright ugly but that does not make it malicious. Anyways, the CSEC report did have its intended effect and now significant resources are being expended to refactor legacy code. Nothing motivates management like a possible loss of revenue from bad PR ;) Then again the NSA hacked into Huawei HQ[2] so they might know something that others don't. Speaking of which, how is the search for WMDs in Iraq coming along? 1: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/626110/20170413_HCSEC_Oversight_Board_Report_2017_-_FINAL.pdf https://assets.publishing.service.gov.uk/government/uploads/... 2: https://www.nytimes.com/2014/03/23/world/asia/nsa-breached-chinese-servers-seen-as-spy-peril.html https://www.nytimes.com/2014/03/23/world/asia/nsa-breached-c...
- le_clochard 8y ago
  This is not the first time. Huawei was banned from supplying for India's National Broadband Network in 2012, and has again been banned from supplying for India's 5G revamp. Not all employees would be in on the espionage attempts either. It'd have to be a very limited circle that knows about it.

unixhero 8y ago

Welp. It's fairly ubiquitous.

ojbyrne 8y ago

Pretty hard argument to make after the US decided Canadian steel is a threat to national security.

lamarpye 8y ago
Maybe if you treat "Canada as a national security treat" as a posture during trade negotiations, it might not be such a hard argument.

vorticalbox 8y ago

Next they will be calling to ban all toy imports in case they continue microphones.

rexpop 8y ago
A classic Phildickian premise; see his 1959 story "War Game."

oger 8y ago

Pick your poison.

moretosee 8y ago

I think Germany will definitely refuse the propose as Merkel's phone was tapped by US. https://www.telegraph.co.uk/news/worldnews/europe/germany/10407282/Barack-Obama-approved-tapping-Angela-Merkels-phone-3-years-ago.html https://www.telegraph.co.uk/news/worldnews/europe/germany/10...

tjpnz 8y ago

I would've expected better from the current NZ government but this response really illustrates just how utterly compromised the country is when it comes to China. There was a similar muted response a few months ago to Chinese CCTV cameras which had been installed inside government ministries.

pilsetnieks 8y ago
At least those you can quarantine on a network level; it's much harder (or really impossible) when it's networking equipment that's suspect.

balibebas 8y ago

Little known fact: The stock video app in EMUI 8 running found in stock P20 Pros from authorized dealers in Singapore regularly make requests to Facebook over over IPv4 and IPv6 even though it only supports local video content. t.me/paranoic for proofs.

balibebas 8y ago
To be fair, Google regularly tries to grab GPS data using its 1e100.net domain (see above # for additional proofs). The only way I've found to block this kind of intrusion is NetGuard in "lockdown" mode.

danmaz74 8y ago

I had understood that the current US administration's point of view was that the US had no allies, but only leeches hell bent on ripping off the US? So, I'm wondering which allies they're talking to.

ThomPete 8y ago
That the wrong understanding.

stanulilic 8y ago

Good move.

kushti 8y ago

American regime is truly terrible. I boycott all the American for years, and wonder how many people are doing the same in 2018.

TsomArp 8y ago

I don't get it. Isn't everything or almost everything being built in china nowadays? If you don't trust them, build in house.

londons_explore 8y ago

When will people learn - 'secure the connections, not the network'. You don't trust the internet, and you shouldn't trust your internal network either. Every connection between devices should be encrypted as if it's going over the internet. That's the basis of BeyondCorp, and many companies are going that way. It's far more sensible to secure just two endpoints than it is to also secure all the wireless links, routers, and cables between them. Now, when the adversary gets control of your routers, it doesn't matter - they can't steal anything of value. The worst they can do is cause a brief outage, for which they'll be immediately detected.

libdjml 8y ago
Sure, that’s a great idea. But your transport security is going to show vulnerability sooner or later (see: regular issues in TLS), and it’s worth having a slightly less compromised network fabric. I agree with your general sentiment though.
shawn 8y ago
This is mistaken. If an adversary has control of your routers, they have a way to pivot into your computers. I used to do this for a living.
aembleton 8y ago
But they can slow down the traffic or disconnect it completely. If an entire countries 5G infrastructure is built by a single company that can push updates to the infrastructure, then it can completely disable it.

levosmetalo 8y ago

This implies that US can't reach the data from Huawei. So it seems that Huawei is the safest option for any US and European citizen. I'd rather have my data safe with the Chinese government, a country that is on the other side of the globe and has practically zero influence on my life, that sharing it with the US or my own governments, which are there, and can make my life hell for any or no reason at all, and have the means to actually hurt me. And yes, if I can't avoid it, I'd much rather share my internet search history with an unknown entity on the other side of the world, than with my own wife.

Gorbzel 8y ago
This might be the stupidest rationalization ever posted on HN.
- tylerl 8y ago
  ...which is saying something.
detaro 8y ago
In the Snowden leaks there was a bunch of evidence that US intelligence at least had deep access to Huawei: https://mashable.com/2014/03/22/nsa-huawei/ https://mashable.com/2014/03/22/nsa-huawei/
- SwellJoe 8y ago
  A system with a backdoor is a system exploitable by a high capability attacker, like most major state intelligence agencies.
  - Jyaif 8y ago
    Not if the output of the backdoor is encrypted.
    - Retric 8y ago

deleted 8y ago

[deleted]

vectorEQ 8y ago

haha good luck , whole countries networks / isp networks get managed by them. sure US will cover for those costs of changing with their fiat currency.

toxik 8y ago
Other telecom actors were steamrolled by the government-backed Huawei telecom network deals. Ericsson for example could not keep up because the EU doesn't believe in protectionism, at least at that level.

cbzbc 8y ago

Within the UK Huawei has won a number of network refresh contracts with BT. I assume this then got levels of concern going within the various agencies, as this was one of the results: https://www.gov.uk/government/publications/huawei-cyber-security-evaluation-centre-oversight-board-annual-report-2015 https://www.gov.uk/government/publications/huawei-cyber-secu... A factory within the UK, owned by Huawei's UK arm - with restrictions entry, that is then used for security assurance of the products BT uses.

johannkokos 8y ago

No one talks about the story from financial perspective? How much will Huawei lose, who is the competitor against Huawei? IMO it's the extension of trade war between US and China.

Bizarro 8y ago

China does something bad. Whataboutism. Rinse, Repeat. Nobody's mind is changed, even though everybody thinks they're going to make some great argument. What a waste of keystrokes.

Havoc 8y ago

In other news - my Huawei tablet arrived today & this was one of the first articles I read on it oh the irony

throw2016 8y ago

There are too many double standards here, about capitalism, free trade, technological progress. There is a legitimate reason to be concerned about backdoors and spyware, but why should this 'concern' be limited to a single country in this self serving way? What this really says is that some companies and countries can access all markets without concerns but when others try to grow their market access will be restricted with scaremongering, bullying and political games perpetuating an artificial marketplace. Its the ideologues who always argue on 'free markets' and 'competition' in absolute terms who should wake up to how little the real world has to do with their idealized constructs.

simonblack 8y ago

Protection for US 5G Corporations to allow them to catch up. Then there's the other side of the coin. The Chinese boycotting of US Corporations. China alone has more population and manufacturing than the US and EU combined. Does the West really want to lose a market that's 20% of the whole world? Probably not. "Trade Wars are good and easy to win." /s

lyrachord 8y ago

I wonder why so many fake mans believes fake news. The saying is: Don't be evil, otherwise devoured by the devil.

StefanKarpinski 8y ago

There's also substantial evidence that Huawei was involved in the murder of a US citizen to cover up attempts to acquire classified US military technology: https://en.wikipedia.org/wiki/Death_of_Shane_Todd https://en.wikipedia.org/wiki/Death_of_Shane_Todd Financial Times story about the case: http://ig-legacy.ft.com/content/afbddb44-7640-11e2-8eb6-00144feabdc0 http://ig-legacy.ft.com/content/afbddb44-7640-11e2-8eb6-0014... Discussion on HN: https://news.ycombinator.com/item?id=5230585 https://news.ycombinator.com/item?id=5230585

deleted 8y ago

[deleted]