8 ms·

Huawei ‘may have eavesdropped on Dutch mobile network’s calls’

116 points by kumarharsh 5y ago

zadwang 5y ago
This could be said of ANY telecom providers. It is all speculation without a shred of fact.
- jijji 5y ago
  It sounds pretty damaging considering the telecom provider hid the report for ten years.
reddotX 5y ago
that's not nice!
xster 5y ago
So it's https://news.ycombinator.com/item?id=26842733 https://news.ycombinator.com/item?id=26842733 but with one more layer of indirection and rephrased to be stated with more confidence without any changes in primary source?
sschueller 5y ago
Interesting how this 3 day old story is getting twisted more and more. Can we stick to the facts? Huawei was used for outsourcing, Huawei obviously has root access. If you outsource your IT to a company with known ties to a foreign government you can't complain about them having sensitive access.
- justicezyx 5y ago
  Now it's not only "true", it's sufficient to be the evidence of national threats (again) https://foreignpolicy.com/2021/04/30/huawei-china-business-risk/ https://foreignpolicy.com/2021/04/30/huawei-china-business-r...
- NicoJuicy 5y ago
  Huawei had employees onsite in the netherlands for access. Unauthorized full network access happened from China. I do agree it's again here and shouldn't be anymore. But don't claim it's normal, the audit reported it as not. KPN even hid the report for 10 years, because it was afraid of it's contents to go public. Ps. Yes, i speak dutch, so I read the original article on Volkskrant.nl . More information is probably getting out soon as it's being inquired currently by their government.
- varispeed 5y ago
  Just because you have a root access, it doesn't mean you can just make yourself at home and grab any data you want.
  - throwaway4good 5y ago
    And it doesn't mean that they did.
    - Boywithhalo 5y ago
      Capgemini report states that unchecked and unauthorized from China happened after October 28 2009; as reported by the journalist that broke this news: https://twitter.com/huibmodderkolk/status/1383350588654592001 https://twitter.com/huibmodderkolk/status/138335058865459200...
      - multiverce 5y ago
        So if anyone accessed from China, it must be huawei? You do know China has 1.4B people. And hackers often use zombie machines to attack. But clearly didn't matter to you.
        NicoJuicy 5y ago
        Huawei was the only one that circumvented the password policy from KPN, which is the telecom provider of > 50% of phone infrastructure in the Netherlands ( including government). The audit was from 2009 and was an internal security audit that got leaked. It's specifically about Huawei.
        throwaway4good 5y ago
        Just because a policy on passwords or root access was broken, it doesn't mean that it was nefarious (as implied here - eavesdropping etc.).
        5y ago
- mc32 5y ago
  Yeah I guess this is like having Kaspersky and then complaining that data was exfiltrated to the FSB or something. Or you know, know who you are dealing with when you outsource.
- contravariant 5y ago
  I don't think the people complaining are the ones who chose to give root access to a company with known ties to a foreign government.
  - amaccuish 5y ago
    Then why do they spin it as if Huawei abused their access? Surely they could just make their opposition known without all the wink wink going on.
    - Boywithhalo 5y ago
      Who is the 'they' in your comment? The Capgemini report underlying all this, in no unclear terms, states that Huawei abused their access; with unmonitored and unauthorized access from China. Additionally, it concludes that Dutch telecom act was violated by Huawei by being able to access the numbers being tapped by Dutch security services. All statements in the original news article are backed up by the Capgemini report. Of course this report could be wrong, but then it's curious why KPN decided to keep this report a secret, apart from sharing the results with Dutch intelligence (AIVD). Either way, I have a hard time seeing how any of this is 'spin'.
    - contravariant 5y ago
      I don't need to spin anything. I hereby oppose Huawei having this kind of unlimited and unchecked access in past present and future. The only part that is unclear, and may never be clear, is whether this authority has been abused. However I oppose them (or anyone) having the authority in the first place.
jariel 5y ago
There's some debate about the degree to which the authorization could have been abused, but it today's world it's just hard to imagine how such rights and authorization could be granted in the first place.
bondarchuk 5y ago
My (amateurish) translation of the Volkskrant article: https://0bin.net/paste/poCzYk4t#IRjhnXLT31zdiDMCVJIIqvZgLDqh4mx8M8NjBstgxly https://0bin.net/paste/poCzYk4t#IRjhnXLT31zdiDMCVJIIqvZgLDqh...
nottorp 5y ago
Funny, a couple days ago the title was "Huawei spied on Dutch bla bla". Today it's "may have spied". The original article (well, the translation bondarchuk posted here) says they had the access. Not that they did anything with it.
- NicoJuicy 5y ago
  You're tldr; is a bit wrong. They had unauthorized access, which means they used it. It's not clear for what currently, that's why it describes the scope of access. They also found that the application can tap entire phone calls, which was forbidden. Edit: What do you think the following means ( Dutch is my native tongue, lol): > ‘Ongecontroleerde en ongeautoriseerde toegang vanuit China heeft na 28 oktober 2009 daadwerkelijk plaatsgevonden’, vermeldt het rapport in april 2010. Translation: Unchecked and unauthorized access has taken place from china after 28 October 2009. Original article: http://webcache.googleusercontent.com/search?q=cache:https://www.volkskrant.nl/nieuws-achtergrond/huawei-kon-alle-gesprekken-van-mobiele-kpn-klanten-afluisteren-inclusief-die-van-de-premier~bd1aece1 http://webcache.googleusercontent.com/search?q=cache:https:/...
  - nottorp 5y ago
    It says they were doing the network maintenance, so my guess is they cut some corners and had their people in China do it fast.
    - NicoJuicy 5y ago
      It doesn't say that ( I speak Dutch ). It says that they could tap phone-calls in KPN's network anytime and anywhere without anyone knowing. It's not what it states. It says that Huawei does the core of the mobile network ( eg. switches). If they want access, they have to ask it and they will generate a security code. > Als Huawei erbij wil, moet het bedrijf bij het Netwerk Operations Center van KPN een veiligheidscode aanvragen. Daarna bereiden technici van KPN de toegang voor. Alleen dan kan Huawei in het hart van het netwerk. But Huawei seems to get access from China outside of this procedure. > Maar het gaat toch verkeerd. Huawei blijkt zich buiten de procedure om vanuit China toegang tot de kern van het netwerk te verschaffen. Veiligheidsmensen van KPN weten dat dit gebeurt, maar doen niets. ‘Ongecontroleerde en ongeautoriseerde toegang vanuit China heeft na 28 oktober 2009 daadwerkelijk plaatsgevonden’, vermeldt het rapport in april 2010. They found an additional serious breach. A program to listen to every phone call within the network of KPN. > zes Chinese medewerkers werken met een programma dat hen in staat stelt om elk telefoongesprek dat via KPN gaat mee te luisteren. Ook dat is in strijd met afspraken. Listening to an entire phone call is forbidden. > Huawei heeft contractueel de mogelijkheid om voor kwaliteitsdoeleinden een gesprek kortstondig – enkele seconden – te volgen, dat heet inluisteren. Het hele gesprek volgen – meeluisteren – is verboden. Source: the original article from the volkskrant: https://www.volkskrant.nl/nieuws-achtergrond/huawei-kon-alle-gesprekken-van-mobiele-kpn-klanten-afluisteren-inclusief-die-van-de-premier~bd1aece1 https://www.volkskrant.nl/nieuws-achtergrond/huawei-kon-alle...
dathinab 5y ago
It's still the same news and it's still: - could have eavesdropped - likely wouldn't have been found out - but there is no indication that they did so In the end Huawei (the company) has no benefits and IMHO no intention to spy on the Dutch mobile network. The problem is that the employees of Huawei, independent of nationality, might be a different story. (Or more precise China or the USA pressuring employees or installing "their people" in the right technical positions). But as a side note that is also true for the USA, not just China. It's just that for all western/(somewhat proper) democratic countries the US is much closer ideological and political then China, even with all the faults the USA has. Like e.g China is a "de-facto" one party system (theoretical they have more) and the US is a "de-facto" two party system. Which is better but still not proper democratic.
elric 5y ago
It's interesting to see how this speculative piece keeps popping up, whereas GCHQ's THREE YEAR long hack [1] of Belgium's largest ISP was largely ignored. China bashing is easier than Five-Eyes bashing? [1] https://en.wikipedia.org/wiki/Operation_Socialist https://en.wikipedia.org/wiki/Operation_Socialist
- planck01 5y ago
  How do you mean 'was largely ignored'? It was headline news for almost a year during the snowden period. It still is discussed occasionally and both us and uk are trusted less by eu countries because of it.
  - elric 5y ago
    Maybe I'm wrong about this, but I don't remember there being this much noise about it. Sure, the rest of the Snowden revelations, but the GCHQ hack seemed largely forgotten. IIRC no charges were ever filed and there was no diplomatic response.
    - estaseuropano 5y ago
      There was a lot of diplomatic fallout but that doesn't take place in public. Reportedly the other EU secret services became more careful about sharing with UK.
de6u99er 5y ago
Those articles are just FUD.
LatteLazy 5y ago
It's quite incredible really. We have undeniable proof the US spies on the EU, phone taps it's leaders, and uses the info to help US companies. But the stories are all about a Chinese company once having done a thing they were asked to do...
- Out_of_Characte 5y ago
  What no. How did you even get to that conclusion?
  - LatteLazy 5y ago
    Which conclusion? That the US wiretapped EU leaders [0]? Or something else? [0] https://www.theguardian.com/world/2013/jun/30/nsa-leaks-us-bugging-european-allies https://www.theguardian.com/world/2013/jun/30/nsa-leaks-us-b...
    - Out_of_Characte 5y ago
      >stories are all about a Chinese company once having done a thing they were asked to do... The dutch governement and the dutch telecom providers did NOT ask any chinese governement or huwawei to eavesdrop or do any kind of work of the sorts. From the source ( volkskrant ) "Huawei was in staat om zowel binnen KPN als vanuit China ‘ongeautoriseerd, ongecontroleerd en ongelimiteerd KPN-mobiele nummers af te luisteren’, inclusief die van ministers, toenmalig minister-president Jan Peter Balkenende en Chinese dissidenten. Tevens had Huawei inzicht in de database met afgetapte telefoonnummers. Dat is in strijd met de Telecommunicatiewet." Roughly translates to: Huawei has unlimited access to listen to every KPN-number including those of ministers and chinese dissidents and had insights into databases with tapped phonenumbers without authorisation or oversight which was in violation with the Telecommunication law This story is mainly about KPN's incompetence but also about the massive influence Huawei or the chinese government has over KPN's network. There's no evidence of misuse but there also wouldn't be any evidence to begin with if there was misuse as they had full control over the network.
- jariel 5y ago
deleted 5y ago
[deleted]
egberts1 5y ago
so Guardian retranslated Dutch strict wordings into English loose wordings. tsk tsk tsk.

116 points by kumarharsh 5y ago

zadwang 5y ago

This could be said of ANY telecom providers. It is all speculation without a shred of fact.

jijji 5y ago
It sounds pretty damaging considering the telecom provider hid the report for ten years.

reddotX 5y ago

that's not nice!

xster 5y ago

So it's https://news.ycombinator.com/item?id=26842733 https://news.ycombinator.com/item?id=26842733 but with one more layer of indirection and rephrased to be stated with more confidence without any changes in primary source?

sschueller 5y ago

Interesting how this 3 day old story is getting twisted more and more. Can we stick to the facts? Huawei was used for outsourcing, Huawei obviously has root access. If you outsource your IT to a company with known ties to a foreign government you can't complain about them having sensitive access.

justicezyx 5y ago
Now it's not only "true", it's sufficient to be the evidence of national threats (again) https://foreignpolicy.com/2021/04/30/huawei-china-business-risk/ https://foreignpolicy.com/2021/04/30/huawei-china-business-r...
NicoJuicy 5y ago
Huawei had employees onsite in the netherlands for access. Unauthorized full network access happened from China. I do agree it's again here and shouldn't be anymore. But don't claim it's normal, the audit reported it as not. KPN even hid the report for 10 years, because it was afraid of it's contents to go public. Ps. Yes, i speak dutch, so I read the original article on Volkskrant.nl . More information is probably getting out soon as it's being inquired currently by their government.
varispeed 5y ago
Just because you have a root access, it doesn't mean you can just make yourself at home and grab any data you want.
- throwaway4good 5y ago
  And it doesn't mean that they did.
  - Boywithhalo 5y ago
    Capgemini report states that unchecked and unauthorized from China happened after October 28 2009; as reported by the journalist that broke this news: https://twitter.com/huibmodderkolk/status/1383350588654592001 https://twitter.com/huibmodderkolk/status/138335058865459200...
    - multiverce 5y ago
      So if anyone accessed from China, it must be huawei? You do know China has 1.4B people. And hackers often use zombie machines to attack. But clearly didn't matter to you.
      - NicoJuicy 5y ago
        Huawei was the only one that circumvented the password policy from KPN, which is the telecom provider of > 50% of phone infrastructure in the Netherlands ( including government). The audit was from 2009 and was an internal security audit that got leaked. It's specifically about Huawei.
        throwaway4good 5y ago
        Just because a policy on passwords or root access was broken, it doesn't mean that it was nefarious (as implied here - eavesdropping etc.).
        5y ago
mc32 5y ago
Yeah I guess this is like having Kaspersky and then complaining that data was exfiltrated to the FSB or something. Or you know, know who you are dealing with when you outsource.
contravariant 5y ago
I don't think the people complaining are the ones who chose to give root access to a company with known ties to a foreign government.
- amaccuish 5y ago
  Then why do they spin it as if Huawei abused their access? Surely they could just make their opposition known without all the wink wink going on.
  - Boywithhalo 5y ago
    Who is the 'they' in your comment? The Capgemini report underlying all this, in no unclear terms, states that Huawei abused their access; with unmonitored and unauthorized access from China. Additionally, it concludes that Dutch telecom act was violated by Huawei by being able to access the numbers being tapped by Dutch security services. All statements in the original news article are backed up by the Capgemini report. Of course this report could be wrong, but then it's curious why KPN decided to keep this report a secret, apart from sharing the results with Dutch intelligence (AIVD). Either way, I have a hard time seeing how any of this is 'spin'.
  - contravariant 5y ago
    I don't need to spin anything. I hereby oppose Huawei having this kind of unlimited and unchecked access in past present and future. The only part that is unclear, and may never be clear, is whether this authority has been abused. However I oppose them (or anyone) having the authority in the first place.

jariel 5y ago

There's some debate about the degree to which the authorization could have been abused, but it today's world it's just hard to imagine how such rights and authorization could be granted in the first place.

bondarchuk 5y ago

My (amateurish) translation of the Volkskrant article: https://0bin.net/paste/poCzYk4t#IRjhnXLT31zdiDMCVJIIqvZgLDqh4mx8M8NjBstgxly https://0bin.net/paste/poCzYk4t#IRjhnXLT31zdiDMCVJIIqvZgLDqh...

nottorp 5y ago

Funny, a couple days ago the title was "Huawei spied on Dutch bla bla". Today it's "may have spied". The original article (well, the translation bondarchuk posted here) says they had the access. Not that they did anything with it.

NicoJuicy 5y ago
You're tldr; is a bit wrong. They had unauthorized access, which means they used it. It's not clear for what currently, that's why it describes the scope of access. They also found that the application can tap entire phone calls, which was forbidden. Edit: What do you think the following means ( Dutch is my native tongue, lol): > ‘Ongecontroleerde en ongeautoriseerde toegang vanuit China heeft na 28 oktober 2009 daadwerkelijk plaatsgevonden’, vermeldt het rapport in april 2010. Translation: Unchecked and unauthorized access has taken place from china after 28 October 2009. Original article: http://webcache.googleusercontent.com/search?q=cache:https://www.volkskrant.nl/nieuws-achtergrond/huawei-kon-alle-gesprekken-van-mobiele-kpn-klanten-afluisteren-inclusief-die-van-de-premier~bd1aece1 http://webcache.googleusercontent.com/search?q=cache:https:/...
- nottorp 5y ago
  It says they were doing the network maintenance, so my guess is they cut some corners and had their people in China do it fast.
  - NicoJuicy 5y ago
    It doesn't say that ( I speak Dutch ). It says that they could tap phone-calls in KPN's network anytime and anywhere without anyone knowing. It's not what it states. It says that Huawei does the core of the mobile network ( eg. switches). If they want access, they have to ask it and they will generate a security code. > Als Huawei erbij wil, moet het bedrijf bij het Netwerk Operations Center van KPN een veiligheidscode aanvragen. Daarna bereiden technici van KPN de toegang voor. Alleen dan kan Huawei in het hart van het netwerk. But Huawei seems to get access from China outside of this procedure. > Maar het gaat toch verkeerd. Huawei blijkt zich buiten de procedure om vanuit China toegang tot de kern van het netwerk te verschaffen. Veiligheidsmensen van KPN weten dat dit gebeurt, maar doen niets. ‘Ongecontroleerde en ongeautoriseerde toegang vanuit China heeft na 28 oktober 2009 daadwerkelijk plaatsgevonden’, vermeldt het rapport in april 2010. They found an additional serious breach. A program to listen to every phone call within the network of KPN. > zes Chinese medewerkers werken met een programma dat hen in staat stelt om elk telefoongesprek dat via KPN gaat mee te luisteren. Ook dat is in strijd met afspraken. Listening to an entire phone call is forbidden. > Huawei heeft contractueel de mogelijkheid om voor kwaliteitsdoeleinden een gesprek kortstondig – enkele seconden – te volgen, dat heet inluisteren. Het hele gesprek volgen – meeluisteren – is verboden. Source: the original article from the volkskrant: https://www.volkskrant.nl/nieuws-achtergrond/huawei-kon-alle-gesprekken-van-mobiele-kpn-klanten-afluisteren-inclusief-die-van-de-premier~bd1aece1 https://www.volkskrant.nl/nieuws-achtergrond/huawei-kon-alle...

dathinab 5y ago

It's still the same news and it's still: - could have eavesdropped - likely wouldn't have been found out - but there is no indication that they did so In the end Huawei (the company) has no benefits and IMHO no intention to spy on the Dutch mobile network. The problem is that the employees of Huawei, independent of nationality, might be a different story. (Or more precise China or the USA pressuring employees or installing "their people" in the right technical positions). But as a side note that is also true for the USA, not just China. It's just that for all western/(somewhat proper) democratic countries the US is much closer ideological and political then China, even with all the faults the USA has. Like e.g China is a "de-facto" one party system (theoretical they have more) and the US is a "de-facto" two party system. Which is better but still not proper democratic.

elric 5y ago

It's interesting to see how this speculative piece keeps popping up, whereas GCHQ's THREE YEAR long hack [1] of Belgium's largest ISP was largely ignored. China bashing is easier than Five-Eyes bashing? [1] https://en.wikipedia.org/wiki/Operation_Socialist https://en.wikipedia.org/wiki/Operation_Socialist

planck01 5y ago
How do you mean 'was largely ignored'? It was headline news for almost a year during the snowden period. It still is discussed occasionally and both us and uk are trusted less by eu countries because of it.
- elric 5y ago
  Maybe I'm wrong about this, but I don't remember there being this much noise about it. Sure, the rest of the Snowden revelations, but the GCHQ hack seemed largely forgotten. IIRC no charges were ever filed and there was no diplomatic response.
  - estaseuropano 5y ago
    There was a lot of diplomatic fallout but that doesn't take place in public. Reportedly the other EU secret services became more careful about sharing with UK.

de6u99er 5y ago

Those articles are just FUD.

LatteLazy 5y ago

It's quite incredible really. We have undeniable proof the US spies on the EU, phone taps it's leaders, and uses the info to help US companies. But the stories are all about a Chinese company once having done a thing they were asked to do...

Out_of_Characte 5y ago
What no. How did you even get to that conclusion?
- LatteLazy 5y ago
  Which conclusion? That the US wiretapped EU leaders [0]? Or something else? [0] https://www.theguardian.com/world/2013/jun/30/nsa-leaks-us-bugging-european-allies https://www.theguardian.com/world/2013/jun/30/nsa-leaks-us-b...
  - Out_of_Characte 5y ago
    >stories are all about a Chinese company once having done a thing they were asked to do... The dutch governement and the dutch telecom providers did NOT ask any chinese governement or huwawei to eavesdrop or do any kind of work of the sorts. From the source ( volkskrant ) "Huawei was in staat om zowel binnen KPN als vanuit China ‘ongeautoriseerd, ongecontroleerd en ongelimiteerd KPN-mobiele nummers af te luisteren’, inclusief die van ministers, toenmalig minister-president Jan Peter Balkenende en Chinese dissidenten. Tevens had Huawei inzicht in de database met afgetapte telefoonnummers. Dat is in strijd met de Telecommunicatiewet." Roughly translates to: Huawei has unlimited access to listen to every KPN-number including those of ministers and chinese dissidents and had insights into databases with tapped phonenumbers without authorisation or oversight which was in violation with the Telecommunication law This story is mainly about KPN's incompetence but also about the massive influence Huawei or the chinese government has over KPN's network. There's no evidence of misuse but there also wouldn't be any evidence to begin with if there was misuse as they had full control over the network.
jariel 5y ago

deleted 5y ago

[deleted]

egberts1 5y ago

so Guardian retranslated Dutch strict wordings into English loose wordings. tsk tsk tsk.