7 ms·

The justification is that the equipment presents a national security risk. If that's true, how is it reasonable to allow this equipment to operate in the UK fo

The justification is that the equipment presents a national security risk. If that's true, how is it reasonable to allow this equipment to operate in the UK for 7 more years? Doesn't that mean the UK is willingly under national security risk for 7 years? Unless, of course, there was never a security risk...

tomfanning 6y ago
Not dissimilar to how face masks are being made compulsory in shops by the British government. In 11 days' time.
- mytailorisrich 6y ago
  And 2 days ago Gove said they wouldn't be compulsory. They are just panicking because of the economy (latest figures show a 20% crash).
- nicky0 6y ago
  Future-dating it is a sensible move to allow people to get used to the idea, to disseminate the news, and to allow time to obtain the necessary equipment. It will increase compliance compared to an immediate rule change. Bear in mind that only about 5%-10% of people in UK currently are wearing masks in shops (based on my own local observations).
  - ben_w 6y ago
    While that is true, these rules should’ve been brought in months ago. (Also: do people really need more than one week?)
    - nicky0 6y ago
      Months ago there were massive shortages of PPE and UK was largely in lockdown with most people only going out to exercise and to shop, not going anywhere else, and not seeing famliy, friends etc. Now the risk profile of things has changed because people are out and about more. But 11 days does seem a bit long, sure.
      - ben_w 6y ago
        The masks normal people need to wear aren’t the same masks that medical staff need to wear — the former mainly stop you infecting others, the later keep you safe from others.
- krona 6y ago
  You're assuming everyone who must to go to a shop in the next 11 days already have in their possession an appropriate face covering; the definition of which is as yet unknown.
  - reallydontask 6y ago
    they could introduce the measure immediately for all but essential shops, with essential shops a week later to allow people to acquire appropriate face covering
  - blhack 6y ago
    If the face masks are that essential (which they probably are): wrap a t shirt around your face.
- boopmaster 6y ago
  yet, dissimilar in so many ways (number of manufacturers, ease of access, cost, offenses against fellow humans notwithstanding)
nicky0 6y ago
Presumably it's about judging what is an acceptable degree of risk vs stripping out all Huawei equipment immediately and effecively crippling the nation's comms infrastrtucture.
- ben_w 6y ago
  Is 5G really already “critical”? I thought it was only just starting to be phased in when the virus became more important to worry about.
  - dazc 6y ago
    It isn't just 5G, Huawei equipment is used throughout the telecom industry.
    - nicky0 6y ago
      Which does raise the question, why are we concerned about 5G when Huawei is presumably also behind much of the 4G and other existing infrastructure? What's the difference in terms of security risk?
      - dazc 6y ago
        One reason explained here https://news.ycombinator.com/item?id=23831435 https://news.ycombinator.com/item?id=23831435
room271 6y ago
Our governments balance these concerns all the time: economic cost vs security risk. It's very normal.
goalieca 6y ago
I see you've never been in charge of risk mitigation measures. I do them as part of my job and am tasked with scoring risks and possible mitigation responses. Sometimes the mitigation is so effective that it can eliminate the risk but other times it is practically useless. Decision makers then need to asses those risks and possible mitigations and weigh them against a million other factors.
krona 6y ago
Many things represent a national security risk. Switching off the equipment overnight, I would argue, also represents a risk to national security.
- andylynch 6y ago
  That is exactly what BT have been saying. Moreover they rightly point out that losing access to software updates due to US sanctions is a security risk in its own right too.
  - Ericson2314 6y ago
    Heh, they should reverse engineer the devices and do their own software firmware.
geogra4 6y ago
Right. I think it's mostly just to keep the US happy.
georgespencer 6y ago
This is a good example of the kinds of tradeoffs which must be made at the highest levels of public service. > Doesn't that mean the UK is willingly under national security risk for 7 years? No, and I'll come on to why in a second. Huawei, just like any Chinese corporation operating overseas, is an attack vector for intelligence gathering. Anyone presenting a counter-argument to this is either a shill for the Chinese government, or totally uninformed. China has a culturally distinct attitude towards intelligence and intelligence gathering to nearly every western country. The national emphasis on the collective good blurs the line between private citizens, acting in a personal or professional capacity, and the stereotypical impression of a "spy" perpetuated in the west: on the payroll, going to their cubicle at the CIA each day. China's voracious appetite for intelligence (and, particularly in recent years, industrial espionage), means that it is impossible to distinguish between the commercial interests of a Chinese company and the Chinese state furthering its apparatus. Remember Crypto AG? The Swiss crypto company jointly-operated by the CIA and German intelligence?[1] That's newsworthy because it's unusual: western states are typically limited to publicly lobbying their corporations for backdoor access, or working around things like end-to-end encryption (e.g. I believe PRISM used a combination of vulnerabilities to exfiltrate data from Hotmail and MSN prior to encryption taking place). In China, we must assume that the reverse is the norm: the Chinese government does not need to lobby its companies to provide it with data, or to build-in backdoors or exploits. A Chinese corporation can be compelled to turn over everything it has, silently, and to compromise users and products to benefit the Chinese government, silently. Crucially this is not a criticism of China. China can best be understood by Westerners as a series of tradeoffs to benefit the collective good, at the expense of personal liberty and privacy. Literally the argument you might encounter would be: "If you have nothing to hide then why do you care?" The information gathered is not always as exciting as you might imagine. It's not just deployed into military intelligence or kompromat. It might "just" be used as a means of preserving China's status quo as a leading manufacturing hub (and, therefore, China's position as a growing economic power). So China a) has a vast appetite for intelligence of all kinds, and b) does not draw a distinction between private citizens/corporations and state actors/corporations. To answer your question: Huawei has been a cornerstone of the UK's telecoms infrastructure for nearly twenty years, and in order to gain its foothold committed to allowing GCHQ full access to its codebase (HCSEC)[2]. The stipulation from Britain's intelligence community was that Huawei must not be allowed to have a monopoly position, or even a significant market share beyond a certain level. I am not familiar with the specific technical reason that Huawei at 70% vs. Huawei at 40% of the UK's telecoms infrastructure would represent a disproportionate increase in risk, but I believe it is likely to be related to resource constraints -- fuck me guys, GCHQ is having to actively monitor and review the code deployed across a double-digit % of our telecoms infrastructure from the starting position of "this is provided by a bad actor"! -- and the doomsday scenario that Huawei's position of market dominance would drive competition down, resulting in a choice to either have e.g. 7G with Huawei, or not at all (7G is a fictitious example, but you see my point). The UK is balancing the very real ongoing nightmare of monitoring Huawei's involvement in UK telecoms with the fact that it's a cheap, high quality supplier, and the fact that our closest allies -- the United States -- have been on a warpath over Chinese intelligence gathering since long before Obama put the kibosh on China acquiring Aixtron in Germany for national security reasons. Oh, and we want to get a trade deal out of the US in the near future. The risk:reward for Huawei is at a point where it's no longer sustainable. Phasing its removal from our infrastructure will smooth our relationship with our closest ally, reduce our reliance on a Chinese state manufacturer, and reduce the workload on our signals analysts in GCHQ. [1] https://www.theguardian.com/us-news/2020/feb/11/crypto-ag-cia-bnd-germany-intelligence-report https://www.theguardian.com/us-news/2020/feb/11/crypto-ag-ci... [2] https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/790270/HCSEC_OversightBoardReport-2019.pdf https://assets.publishing.service.gov.uk/government/uploads/...
beezle 6y ago
Because it will be obsolete and 6G will be the new hotness in seven years.
- orwin 6y ago
  I think we just passed peak production in europe last year, i highly doubt we will be able to afford more energetically expensive devices anytime soon without overexploiting shell oil.

tomfanning 6y ago

Not dissimilar to how face masks are being made compulsory in shops by the British government. In 11 days' time.

mytailorisrich 6y ago
And 2 days ago Gove said they wouldn't be compulsory. They are just panicking because of the economy (latest figures show a 20% crash).
nicky0 6y ago
Future-dating it is a sensible move to allow people to get used to the idea, to disseminate the news, and to allow time to obtain the necessary equipment. It will increase compliance compared to an immediate rule change. Bear in mind that only about 5%-10% of people in UK currently are wearing masks in shops (based on my own local observations).
- ben_w 6y ago
  While that is true, these rules should’ve been brought in months ago. (Also: do people really need more than one week?)
  - nicky0 6y ago
    Months ago there were massive shortages of PPE and UK was largely in lockdown with most people only going out to exercise and to shop, not going anywhere else, and not seeing famliy, friends etc. Now the risk profile of things has changed because people are out and about more. But 11 days does seem a bit long, sure.
    - ben_w 6y ago
      The masks normal people need to wear aren’t the same masks that medical staff need to wear — the former mainly stop you infecting others, the later keep you safe from others.
krona 6y ago
You're assuming everyone who must to go to a shop in the next 11 days already have in their possession an appropriate face covering; the definition of which is as yet unknown.
- reallydontask 6y ago
  they could introduce the measure immediately for all but essential shops, with essential shops a week later to allow people to acquire appropriate face covering
- blhack 6y ago
  If the face masks are that essential (which they probably are): wrap a t shirt around your face.
boopmaster 6y ago
yet, dissimilar in so many ways (number of manufacturers, ease of access, cost, offenses against fellow humans notwithstanding)

nicky0 6y ago

Presumably it's about judging what is an acceptable degree of risk vs stripping out all Huawei equipment immediately and effecively crippling the nation's comms infrastrtucture.

ben_w 6y ago
Is 5G really already “critical”? I thought it was only just starting to be phased in when the virus became more important to worry about.
- dazc 6y ago
  It isn't just 5G, Huawei equipment is used throughout the telecom industry.
  - nicky0 6y ago
    Which does raise the question, why are we concerned about 5G when Huawei is presumably also behind much of the 4G and other existing infrastructure? What's the difference in terms of security risk?
    - dazc 6y ago
      One reason explained here https://news.ycombinator.com/item?id=23831435 https://news.ycombinator.com/item?id=23831435

room271 6y ago

Our governments balance these concerns all the time: economic cost vs security risk. It's very normal.

goalieca 6y ago

I see you've never been in charge of risk mitigation measures. I do them as part of my job and am tasked with scoring risks and possible mitigation responses. Sometimes the mitigation is so effective that it can eliminate the risk but other times it is practically useless. Decision makers then need to asses those risks and possible mitigations and weigh them against a million other factors.

krona 6y ago

Many things represent a national security risk. Switching off the equipment overnight, I would argue, also represents a risk to national security.

andylynch 6y ago
That is exactly what BT have been saying. Moreover they rightly point out that losing access to software updates due to US sanctions is a security risk in its own right too.
- Ericson2314 6y ago
  Heh, they should reverse engineer the devices and do their own software firmware.

geogra4 6y ago

Right. I think it's mostly just to keep the US happy.

georgespencer 6y ago

This is a good example of the kinds of tradeoffs which must be made at the highest levels of public service. > Doesn't that mean the UK is willingly under national security risk for 7 years? No, and I'll come on to why in a second. Huawei, just like any Chinese corporation operating overseas, is an attack vector for intelligence gathering. Anyone presenting a counter-argument to this is either a shill for the Chinese government, or totally uninformed. China has a culturally distinct attitude towards intelligence and intelligence gathering to nearly every western country. The national emphasis on the collective good blurs the line between private citizens, acting in a personal or professional capacity, and the stereotypical impression of a "spy" perpetuated in the west: on the payroll, going to their cubicle at the CIA each day. China's voracious appetite for intelligence (and, particularly in recent years, industrial espionage), means that it is impossible to distinguish between the commercial interests of a Chinese company and the Chinese state furthering its apparatus. Remember Crypto AG? The Swiss crypto company jointly-operated by the CIA and German intelligence?[1] That's newsworthy because it's unusual: western states are typically limited to publicly lobbying their corporations for backdoor access, or working around things like end-to-end encryption (e.g. I believe PRISM used a combination of vulnerabilities to exfiltrate data from Hotmail and MSN prior to encryption taking place). In China, we must assume that the reverse is the norm: the Chinese government does not need to lobby its companies to provide it with data, or to build-in backdoors or exploits. A Chinese corporation can be compelled to turn over everything it has, silently, and to compromise users and products to benefit the Chinese government, silently. Crucially this is not a criticism of China. China can best be understood by Westerners as a series of tradeoffs to benefit the collective good, at the expense of personal liberty and privacy. Literally the argument you might encounter would be: "If you have nothing to hide then why do you care?" The information gathered is not always as exciting as you might imagine. It's not just deployed into military intelligence or kompromat. It might "just" be used as a means of preserving China's status quo as a leading manufacturing hub (and, therefore, China's position as a growing economic power). So China a) has a vast appetite for intelligence of all kinds, and b) does not draw a distinction between private citizens/corporations and state actors/corporations. To answer your question: Huawei has been a cornerstone of the UK's telecoms infrastructure for nearly twenty years, and in order to gain its foothold committed to allowing GCHQ full access to its codebase (HCSEC)[2]. The stipulation from Britain's intelligence community was that Huawei must not be allowed to have a monopoly position, or even a significant market share beyond a certain level. I am not familiar with the specific technical reason that Huawei at 70% vs. Huawei at 40% of the UK's telecoms infrastructure would represent a disproportionate increase in risk, but I believe it is likely to be related to resource constraints -- fuck me guys, GCHQ is having to actively monitor and review the code deployed across a double-digit % of our telecoms infrastructure from the starting position of "this is provided by a bad actor"! -- and the doomsday scenario that Huawei's position of market dominance would drive competition down, resulting in a choice to either have e.g. 7G with Huawei, or not at all (7G is a fictitious example, but you see my point). The UK is balancing the very real ongoing nightmare of monitoring Huawei's involvement in UK telecoms with the fact that it's a cheap, high quality supplier, and the fact that our closest allies -- the United States -- have been on a warpath over Chinese intelligence gathering since long before Obama put the kibosh on China acquiring Aixtron in Germany for national security reasons. Oh, and we want to get a trade deal out of the US in the near future. The risk:reward for Huawei is at a point where it's no longer sustainable. Phasing its removal from our infrastructure will smooth our relationship with our closest ally, reduce our reliance on a Chinese state manufacturer, and reduce the workload on our signals analysts in GCHQ. [1] https://www.theguardian.com/us-news/2020/feb/11/crypto-ag-cia-bnd-germany-intelligence-report https://www.theguardian.com/us-news/2020/feb/11/crypto-ag-ci... [2] https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/790270/HCSEC_OversightBoardReport-2019.pdf https://assets.publishing.service.gov.uk/government/uploads/...

beezle 6y ago

Because it will be obsolete and 6G will be the new hotness in seven years.

orwin 6y ago
I think we just passed peak production in europe last year, i highly doubt we will be able to afford more energetically expensive devices anytime soon without overexploiting shell oil.