13 ms·
Why not publish a specific threat? These vague "The Chinese are up to something but we cannot reveal what" isn't really helpful, particularly given the current
by Someone1234 7y ago
Why not publish a specific threat?
These vague "The Chinese are up to something but we cannot reveal what" isn't really helpful, particularly given the current trade tensions (and political motivations e.g. "bring jobs home").
I'm not really "siding" with the Chinese, they may be up to something, but the US has really done themselves a great deal of damage when their own allies don't really believe them.
Just publish technical information. It isn't hard. It would do huge damage to the Chinese and reinforce the US's whole argument. But yet after over a year, nada.
- newaccoutnas 7y agoThere have been instances whereby a robotic hoover (Xaomi(sp?) one?) have been sending their generated floor maps back to servers in CN, so I don't think it's unreasonable to assume drones could be doing the same thing.
- jdc 7y agoSources?
- newaccoutnas 7y agoIt was on this week's BBC Click program, there was a full room of IoT devices with wireshark showing their packet traces.
- eunos 7y agoI saw a lot of concern about sending data to servers in a specific location such as CN. However, there is no such thing as Custom for Data. So, I think sending data to either CN or any other place is not much different.
- Junk_Collector 7y agoData is subject to export restrictions and customs same as anything else. Some countries even mandate where and how data must be stored.
- Someone1234 7y agoWe're talking national security. I hope nobody is running a Xiaomi robot vacuum at a sensitive or classified site, or any other brand of robot vacuum for that matter... There's a difference between individual invasions of privacy and national security. There's definitely Chinese apps that invade your privacy. There's also Western apps that do too. The question is of national security however.
- mkla 7y agoThere is a difference, and individual privacy is more important. "National security" is a vague term that is always abused to make money, take away liberties or kill people.
- yorwba 7y ago> I hope nobody is running a Xiaomi robot vacuum at a sensitive or classified site, or any other brand of robot vacuum for that matter... Remember when Strava's heatmap of running tracks leaked information about military bases? https://twitter.com/Nrg8000/status/957318498102865920 https://twitter.com/Nrg8000/status/957318498102865920
- ptero 7y agoObserving private homes can help select your targets. By observing the inside of the home you may learn if the owner has access to secrets (national security or commercial), what kind and what level. From where you can switch to traditional methods. My 2c.
- Someone1234 7y agoIt gives you the layout of homes, it doesn't allow you to observe their occupants. It is a spinning laser.
- InitialLastName 7y agoAdd voice control ("Hey Robot, run a sweep") and WiFi and you have a very capable spy system. Not to mention cameras and GPS which could all be justified in terms of improving the performance of robot vacuums.
- taneq 7y agoTeslas send loads of stuff back to Tesla servers which I'd assume are in the U.S. It's not an unusual thing to do in this cloud-happy day and age.
- adventured 7y agoIt's not a debate over whether the US hoovers up information. Most of this US vs China debate centers on one thing: which side do you want to give your information to. That is what is being argued over; that dispute is going to get worse for a while yet as China pushes outward globally in its tech ambitions. The better alternative: I don't want anyone to have my information - unfortunately is largely not going to be an option. The choice will mostly be between the US and China (or in some cases, European tech providers, which will frequently work with the US). If it's not already that way, it certainly is going to be in the next 10 or 20 years.
- taneq 7y agoThe issue is that everyone's burned out by ridiculously long overly-broad EULAs written in impenetrable legalese. The general sentiment even, here on HN where people should know better, is "sure, they SAY they can do those things but (it's just boilerplate | they wouldn't really ever do that stuff | they really just meant this much more benign thing | they need that access to provide the product | it helps them debug problems)". And then people act all shocked when, once again, a company does precisely what it told you it was going to do. A classic example is the "we collect your data to provide X service" / "you can disable service X" that we see all over the place. Everyone reads it as "you can disable data collection" but that's not what it says, and it's not what really happens. The better alternative is to not accept this kind of invasiveness but the ease and convenience of giving in is too seductive for most people, so we invent a comfort belief that it's somehow benign or at worst irrelevant.
- newaccoutnas 7y agoSure, I can imagine that's fine for car telemetry and you enter into that knowing. It's common technology, even pool cars will have a black logging box. Do I expect a device in my home to be mapping out the floorspace and sending that back to unknown parties (whatever the location) without consent? Then no, that's different.
- jdietrich 7y agoThat was Roomba, owned by the American company iRobot. https://www.nytimes.com/2017/07/25/technology/roomba-irobot-data-privacy.html https://www.nytimes.com/2017/07/25/technology/roomba-irobot-...
- newaccoutnas 7y agoI saw this via BBC Click, this weekend. There was a room full of IoT devices and they were showing how chatty they all were via wireshark. They specifically said floormaps had been found being sent back to servers in CN.
- tw04 7y agoLet's assume that they're encrypting the payload before sending it back home and we've broken their encryption techniques. You don't think it would do a lot of harm to publish detailed analyses letting them know we've broken their encryption?
- Someone1234 7y agoYou could publish a white paper demonstrating that "unknown" data is being sent and look at the code/device that is sending it (since they're in the US). There's no need to even break encryption if you have the sending device.
- luckylion 7y agoYeah, that's similar to how we can't let Saddam know that we know where his giant WMD factories and storage facilities are, so you just have to take our word for it...
- tw04 7y agoI don't know how old you were at the time of 9/11 - but there were loud, public voices in the Intelligence Community telling everyone that the WMD situation was fabricated. To the point the only person claiming there were WMDs was Cheney and his inner circle, which is why both the Democrats and our international partners had to be brow beaten into supporting the invasion of Iraq. To claim these two situations are the same is a very, very large stretch.
- coldtea 7y ago>To the point the only person claiming there were WMDs was Cheney and his inner circle, which is why both the Democrats and our international partners had to be brow beaten into supporting the invasion of Iraq. Just "Cheney" and NYT, and CNN, and the entire establishment, sans some voices. Besides the trillion dollar war efforts went on anyway (also against Afghanistan, a below third world country that has almost nothing to do with the, probably Saudi-funded attack). >To claim these two situations are the same is a very, very large stretch. Sure, they're not the same, today things are far worse. Due to the declining status of the US globally, the fabrications, psy-ops, and "trust us" propaganda has sky-rocketed. Watching the mainstream news and the silent compliance of all sides on the bogus narratives is like participating in an alternate reality universe (and that's before we even get to the fake news)...
- Junk_Collector 7y agoWell, the specific concern is that all new tech ships with OTA update capability. Infrastructure should probably never have this in the first place for a variety of reasons, but it does and it will because the of huge cost savings it can enable. When the Chinese government can tightly control the companies under it, and those companies control the OTA update, then nothing produced by those companies can ever be considered safe so longer as China is considered adversarial. The same could absolutely be said about US made products being used in countries that the USA is adversarial against, and that's likely how the USA government started thinking about it. "Hey, what's a great way to deal with China if we go to war? Whataminute, they could do that to US!" Just look at the havoc that has happened unintentionally due to bad updates being pushed out on a large scale and extrapolate to what could happen with a malicious actor at full control.
- TallGuyShort 7y ago>> The same could absolutely be said about US made products being used in countries that the USA is adversarial against Such as, itself.
- Junk_Collector 7y agoWell of course. Every country has at some point been hostile to it's own citizens or some segment of it's population. It's something that the citizenry need to push back on and keep the government in check. But by and large, the US is no where near as adversarial to it's citizens, companies, or infrastructure as China.
- erikpukinskis 7y agoThat claim would need some substantiation. Not sure how you even measure that. Certainly, if you and I started spending repeated 30 minute looking for examples of adversarial actions taken by the US and China against their people, neither of us would run out of examples before tomorrow. So what are you claiming exactly?
- emddudley 7y ago> Just publish technical information. It isn't hard. It would do huge damage to the Chinese and reinforce the US's whole argument. I doubt that it would damage China. The existence of the threat is already well publicized. I think that U.S. intelligence does not talk about specific threats because the attack vectors would probably misunderstood and underestimated by the general public. There would inevitably be pushback like "Gee, we have to give up our drones just because of X?!" The consequences from these types of events aren't felt immediately, and many people perceive that as being equivalent to no consequences at all.
- Someone1234 7y agoThis has nothing to do with convincing the general public. The US is struggling to convince their own allies that the threat is real, and definitely haven't convinced the technical community they need to stop buying e.g. Huawei hardware. > The existence of the threat is already well publicized. Parroting the same vague "there's a threat, but the threat is secret so we cannot tell you about it" isn't well publishing anything. It is bordering on fear mongering. A well publicized threat would be a series of white papers describing in technical terms the weaknesses/backdoors/etc in Chinese manufactured hardware.
- DataWorker 7y agoNo allies doubt the Chinese engage in hacking and other forms of digital espionage. Do other nations need a white paper detailing our weapons systems to believe in our capability? The world doesn’t owe you proof of anything and government intelligence agencies know more than you. Sorry but nobody is going to give you a white paper.
- ovi256 7y agoYou don't need a whitepaper to say "Any device with over-the-air updates (or server-side processing) controlled by a Chinese company can receive anytime new software (thus a payload) controlled by the Chinese intelligence services". This is what's implied.
- 7y ago
- coldtea 7y ago>These vague "The Chinese are up to something but we cannot reveal what" isn't really helpful, particularly given the current trade tensions (and political motivations e.g. "bring jobs home"). Isn't that the purpose? To fuel the trade tensions for the home team. Don't expect truth in trade wars...
- JudgeWapner 7y agoI think the purpose is to drum up FUD for the MIC. If China were really this Big, Bad Threat, we'd cease all trade with them. Nations don't trade with their enemies.
- wonthegame 7y agoMicrosoft did such a write up about a laptop.
- michaelbuckbee 7y agoIs it that they're pointing to vulnerabilities, not exploits? 1. This class of device has known vulnerabilities 2. These devices are still sufficiently novel that they make economical new and different types of attacks 3. Organizations should consider how these vulnerabilities could potentially compromise your current security plans.
- test001only 7y agoThis reminds me of "believe us they have bio-weapons and need to attack Iraq" trope followed in the recent past. This is just building up media narrative and trying to brainwash people, similar to what happened in the past.
- yhoneycomb 7y agoI agree 100%. At this point I am strongly isolationist. If terrorists from another country really start hijacking our planes, let's come up with a solution other than war. War only serves further destabilizes the country, and it definitely shouldn't be on the table unless someone is actually sending troops on our soil. Last resort would be banning incoming visitors from that country. Not ideal, but a MUCH better solution than war in my opinion.
- 34679 7y agoBecause the techniques the Chinese are using in their phones and other tech were most likely pioneered by the NSA and remain classified.
- yhoneycomb 7y agoPretty sure Chinese people would be perfectly capable of developing their own tech if they wanted to
- dictum 7y agoI wonder if public discourse and pop culture in the US will switch from paranoia as a bad or laughable thing (tinfoil hats! area 51!) to paranoia as a civic duty (to some degree, as in WWII and the Cold War). Though it's more jingoistic, I find the latter less infantilizing, when it's coupled with a guarded paranoia about the US too.
- NeedMoreTea 7y agoMcCarthyism 2.0?
- stcredzero 7y agoThese vague "The Chinese are up to something but we cannot reveal what" isn't really helpful, particularly given the current trade tensions This is exacerbated by the very poor levels of security in these devices in general: DEF CON 23 - Robinson and Mitchell - Knocking my neighbors kids cruddy drone offline https://www.youtube.com/watch?v=5CzURm7OpAA https://www.youtube.com/watch?v=5CzURm7OpAA However, to put things into perspective, purpose built security cameras -- even expensive ones from well reputed industry brands -- have had similar very poor levels of very poor security for many years. https://www.youtube.com/watch?v=B8DjTcANBx0 https://www.youtube.com/watch?v=B8DjTcANBx0 It's not really a problem of drones. It's a problem with the poor levels of security in consumer devices in general. It's "as if" the situation has been engineered to let bad actors do lots of spying.
- Communitivity 7y agoThey deserve some credit. The following is a contrived analogy, admittedly not a great one, to illustrate why I suspect they can't give specifics. Imagine if you have a gigantic elephant standing near a village. It's so big that you can only see one of the following, depending on where you stand: a trunk that can suck people up, legs that can smash, a tail that can create a wind that tosses people about. Three people are standing in different places to see each of these: Alice (trunk), Bob (legs), and Charlie (tail - poor Charlie). Someone comes running into the village and leaves an anonymous note saying a huge being is a threat and it is going to smash houses. Except the villagers, if they can figure out who was standing where and what they could see, can tell who left the anonymous note. It was Bob, who could see the legs. Giving the specifics they know about a threat reveals what they know, and what they don't know, and reveals how they might have gotten the information.
- yhoneycomb 7y agoYou analogy is a perfect demonstration of the US government's tendency to make vague, ominous predictions to stoke fear in its populace so that they will unquestioningly go along with its nefarious intents (ie regime change, chemical warfare, airstrikes on innocent people).
- GordonS 7y agoIt does always seems like the US government is using mass media as it's mouthpiece to spout propaganda about the boogeyman de-jour. Anything to deflect away from US matters at home or abroad, anything to keep the populace in constant fear and suspicion - ooh, look what the nasty commies are doing, red danger, oh oh, now it's those terrible immigrants.. oh, now it's those dastardly commies again!
- throw2016 7y agoThis puts to rest all illusions and fantasies of 'free markets', competition, choice and free trade. Markets are political constructs and there is nothing inherently free or fair about them. There is clearly one set of rules in operation for a chosen few whose companies get access to global markets without fearmongering and thus can grow uninhibited and then the real world where evidence-free scaremongering, demonization and sanctions are used to limit market access, sabotage others and destroy competition before it forms. And citizens of the former get the privilege of articulating a set of free market values in a depoliticized context free world that don't hold in the real world. But its better this happens than it doesn't so the rest of the world can see through the self serving hypocrisy and plan accordingly. Those with this mindset will always find a way to limit others.
- docker_up 7y agoAgreed. Saying "there is something" but not revealing what it is only keeps the consumers in the dark. The Chinese would go through their entire chain to make sure they hide their tracks again, etc, so it's not like opportunities like counter-surveillance will remain. It's literally stupid to say they can't reveal what it is because there's no benefit and only makes me think Homeland services are idiots.
- OrgNet 7y agoThey don't say what the threat is because it is the same threat that we are facing from US companies... I'm pretty sure that you can guess it.
- NicoJuicy 7y agoIt's about what could also. Every Chinese company with > 50 employees has a representative of the Communist party on the board. It's defined by law and law works very differently in China.