5 ms·

> Just publish technical information. It isn't hard. It would do huge damage to the Chinese and reinforce the US's whole argument. I doubt that it would damage

> Just publish technical information. It isn't hard. It would do huge damage to the Chinese and reinforce the US's whole argument. I doubt that it would damage China. The existence of the threat is already well publicized. I think that U.S. intelligence does not talk about specific threats because the attack vectors would probably misunderstood and underestimated by the general public. There would inevitably be pushback like "Gee, we have to give up our drones just because of X?!" The consequences from these types of events aren't felt immediately, and many people perceive that as being equivalent to no consequences at all.

Someone1234 7y ago
This has nothing to do with convincing the general public. The US is struggling to convince their own allies that the threat is real, and definitely haven't convinced the technical community they need to stop buying e.g. Huawei hardware. > The existence of the threat is already well publicized. Parroting the same vague "there's a threat, but the threat is secret so we cannot tell you about it" isn't well publishing anything. It is bordering on fear mongering. A well publicized threat would be a series of white papers describing in technical terms the weaknesses/backdoors/etc in Chinese manufactured hardware.
- DataWorker 7y ago
  No allies doubt the Chinese engage in hacking and other forms of digital espionage. Do other nations need a white paper detailing our weapons systems to believe in our capability? The world doesn’t owe you proof of anything and government intelligence agencies know more than you. Sorry but nobody is going to give you a white paper.
- ovi256 7y ago
  You don't need a whitepaper to say "Any device with over-the-air updates (or server-side processing) controlled by a Chinese company can receive anytime new software (thus a payload) controlled by the Chinese intelligence services". This is what's implied.
  - vkou 7y ago
    This is a great argument against all OTA devices. But if the US actually took that threat seriously, half of the Valley would be out of a job tomorrow.
    - howard941 7y ago
      > This is a great argument against all OTA devices Indeed. And for life safety uses it's appropriate. In safety-conscious settings such as those involving line voltages requiring NRTL (UL for ex) listing OTA updates are forbidden: One must have physical access to the device to perform a permitted [0] code update. [0] And the code updates themselves are subject to IEC 60730/UL 1998 or it's back to the NRTL for more testing
      - beenBoutIT 7y ago
        It's a great argument for devices made in the US. We can't trust Chinese tech yet we don't make our own.
  - close04 7y ago
    It feels more likely to imply that "we have no hard evidence". So the argument still boils down to "because China", not "because spying". Which isn't a strong argument if you like to (at least try to) draw your own conclusion and not be fed one. Are you worried that your iPhone or Tesla will be hijacked the same way? You already know this happened before with the knowledge of the companies involved (secret subpoenas or national security letters) or without it (beacon implants).
    - Tsubasachan 7y ago
      Lets be real here "because China" is a decent enough argument in the US at the moment. Just swallow the propaganda.
    - CharlesColeman 7y ago
      > It feels more likely to imply that "we have no hard evidence". There is hard evidence of the vulnerability, which logically follows from any OTA update capability, but there may be no hard evidence of exploitation yet. Think of it this way: if your software has a RCE, you fix or mitigate it regardless if it's actively being exploited or not. > Are you worried that your iPhone or Tesla will be hijacked the same way? That's a very valid concern for some people. Ultimately, software security boils down to "who do you trust?". Say what you will about the US, but your goals and values are very likely less incompatible with those of the US than with those of authoritarian China [1] [2]. [1] https://www.nytimes.com/2013/08/20/world/asia/chinas-new-leadership-takes-hard-line-in-secret-memo.html https://www.nytimes.com/2013/08/20/world/asia/chinas-new-lea... [2] https://en.wikipedia.org/wiki/Document_Number_Nine https://en.wikipedia.org/wiki/Document_Number_Nine
- marcosdumay 7y ago
  > The US is struggling to convince their own allies that the threat is real The US has to convince their allies that buying from China is more dangerous than buying from the US. I don't think anybody doubts there isn't a threat.
ptero 7y ago
> I think that U.S. intelligence does not talk about specific threats because the attack vectors would probably misunderstood and underestimated by the general public. I doubt intelligence agencies care about convincing public one way or another. I suspect they are worried about revealing details of their methods and thus have a blanket "say nothing" default mindset.
- liability 7y ago
  > "I doubt intelligence agencies care about convincing public one way or another" Why say anything at all then? Saying nothing is one thing, but they are saying something. Why the half-hearted messaging? I honestly don't get it.
taneq 7y ago
> I doubt that it would damage China. The existence of the threat is already well publicized. It'd certainly damage Chinese companies and curtail those companies' utility as sources of intelligence. How many drones do you think DJI would sell if it became known that flight logs and aerial photos were being uploaded to the Chinese government? (This is all purely hypothetical but the DJI app is very aggressive about permissions and updates, so they absolutely could if they wanted to. I have a dedicated phone for mine which never gets to connect to the internet, for this very reason.)
- usrusr 7y ago
  > How many drones do you think DJI would sell if it became known that flight logs and aerial photos were being uploaded to the Chinese government Roughly about as many as today. A recreational or content production drone is sitting dead without a battery >>95% of the time. This is a much weaker threat model (both objectively and in the perception of consumers) than all those connected, always-on microphones and cameras installed in homes, offices and pockets. I mention this as a precedent: to many people out there, "the Chinese government" isn't a lot more foreign than "some American tech empire" and data-derived unpleasantries are far more likely to have practical implications for them with US immigration than with the Chinese communist party (because the US is still more open). And yet those people still buy westcoast-designed (and connected) devices like hotcakes.
Tsubasachan 7y ago
Nobody wants to give up cheap Chinese goods and buy expensive American goods (which are all made in China just the same hilariously) simply because America asks so nicely. Yeah I just ordered a Xiaomi mi9 and I feel fine. If there was indeed a threat to national security I trust my own government to make decisions not the US.

Someone1234 7y ago

This has nothing to do with convincing the general public. The US is struggling to convince their own allies that the threat is real, and definitely haven't convinced the technical community they need to stop buying e.g. Huawei hardware. > The existence of the threat is already well publicized. Parroting the same vague "there's a threat, but the threat is secret so we cannot tell you about it" isn't well publishing anything. It is bordering on fear mongering. A well publicized threat would be a series of white papers describing in technical terms the weaknesses/backdoors/etc in Chinese manufactured hardware.

DataWorker 7y ago
No allies doubt the Chinese engage in hacking and other forms of digital espionage. Do other nations need a white paper detailing our weapons systems to believe in our capability? The world doesn’t owe you proof of anything and government intelligence agencies know more than you. Sorry but nobody is going to give you a white paper.
ovi256 7y ago
You don't need a whitepaper to say "Any device with over-the-air updates (or server-side processing) controlled by a Chinese company can receive anytime new software (thus a payload) controlled by the Chinese intelligence services". This is what's implied.
- vkou 7y ago
  This is a great argument against all OTA devices. But if the US actually took that threat seriously, half of the Valley would be out of a job tomorrow.
  - howard941 7y ago
    > This is a great argument against all OTA devices Indeed. And for life safety uses it's appropriate. In safety-conscious settings such as those involving line voltages requiring NRTL (UL for ex) listing OTA updates are forbidden: One must have physical access to the device to perform a permitted [0] code update. [0] And the code updates themselves are subject to IEC 60730/UL 1998 or it's back to the NRTL for more testing
    - beenBoutIT 7y ago
      It's a great argument for devices made in the US. We can't trust Chinese tech yet we don't make our own.
- close04 7y ago
  It feels more likely to imply that "we have no hard evidence". So the argument still boils down to "because China", not "because spying". Which isn't a strong argument if you like to (at least try to) draw your own conclusion and not be fed one. Are you worried that your iPhone or Tesla will be hijacked the same way? You already know this happened before with the knowledge of the companies involved (secret subpoenas or national security letters) or without it (beacon implants).
  - Tsubasachan 7y ago
    Lets be real here "because China" is a decent enough argument in the US at the moment. Just swallow the propaganda.
  - CharlesColeman 7y ago
    > It feels more likely to imply that "we have no hard evidence". There is hard evidence of the vulnerability, which logically follows from any OTA update capability, but there may be no hard evidence of exploitation yet. Think of it this way: if your software has a RCE, you fix or mitigate it regardless if it's actively being exploited or not. > Are you worried that your iPhone or Tesla will be hijacked the same way? That's a very valid concern for some people. Ultimately, software security boils down to "who do you trust?". Say what you will about the US, but your goals and values are very likely less incompatible with those of the US than with those of authoritarian China [1] [2]. [1] https://www.nytimes.com/2013/08/20/world/asia/chinas-new-leadership-takes-hard-line-in-secret-memo.html https://www.nytimes.com/2013/08/20/world/asia/chinas-new-lea... [2] https://en.wikipedia.org/wiki/Document_Number_Nine https://en.wikipedia.org/wiki/Document_Number_Nine
marcosdumay 7y ago
> The US is struggling to convince their own allies that the threat is real The US has to convince their allies that buying from China is more dangerous than buying from the US. I don't think anybody doubts there isn't a threat.

ptero 7y ago

> I think that U.S. intelligence does not talk about specific threats because the attack vectors would probably misunderstood and underestimated by the general public. I doubt intelligence agencies care about convincing public one way or another. I suspect they are worried about revealing details of their methods and thus have a blanket "say nothing" default mindset.

liability 7y ago
> "I doubt intelligence agencies care about convincing public one way or another" Why say anything at all then? Saying nothing is one thing, but they are saying something. Why the half-hearted messaging? I honestly don't get it.

taneq 7y ago

> I doubt that it would damage China. The existence of the threat is already well publicized. It'd certainly damage Chinese companies and curtail those companies' utility as sources of intelligence. How many drones do you think DJI would sell if it became known that flight logs and aerial photos were being uploaded to the Chinese government? (This is all purely hypothetical but the DJI app is very aggressive about permissions and updates, so they absolutely could if they wanted to. I have a dedicated phone for mine which never gets to connect to the internet, for this very reason.)

usrusr 7y ago
> How many drones do you think DJI would sell if it became known that flight logs and aerial photos were being uploaded to the Chinese government Roughly about as many as today. A recreational or content production drone is sitting dead without a battery >>95% of the time. This is a much weaker threat model (both objectively and in the perception of consumers) than all those connected, always-on microphones and cameras installed in homes, offices and pockets. I mention this as a precedent: to many people out there, "the Chinese government" isn't a lot more foreign than "some American tech empire" and data-derived unpleasantries are far more likely to have practical implications for them with US immigration than with the Chinese communist party (because the US is still more open). And yet those people still buy westcoast-designed (and connected) devices like hotcakes.

Tsubasachan 7y ago

Nobody wants to give up cheap Chinese goods and buy expensive American goods (which are all made in China just the same hilariously) simply because America asks so nicely. Yeah I just ordered a Xiaomi mi9 and I feel fine. If there was indeed a threat to national security I trust my own government to make decisions not the US.