9 ms·

The way the last administration rolled this out was certainly with a political narrative, but my guess is it originated with people that weren't thinking at all

The way the last administration rolled this out was certainly with a political narrative, but my guess is it originated with people that weren't thinking at all about politics. The simple story is that core infrastructure is of strategic national importance, and an elevated risk that infrastructure is compromised can never be worth whatever the benefits are of using a particular supplier's equipment. There is no practical way to 100% ensure that every piece of software, and every chip, in every piece of equipment is clean. Chips are especially scary (the push to have domestic chip fab by the US and other countries is about more than just supply chain). This is true when it comes from what are considered trustworthy suppliers as well, but you're dealing with probabilities. I think that regardless of whether this move fits into a political narrative about China, or "economic warfare", the practical basis is that for some types of equipment, the risk is just too large and the ability to mitigate too limited, in general. Unfortunately this was figured out with Huawei/ZTE after the fact, but tbh I don't think the specific company matters at all, it just happened to be they were in this business at the time & based in the wrong country.

deleted 5y ago
[deleted]
martinald 5y ago
I don't know exactly the US story, but the UK has forced operators to remove "5G" huawei equipment. This becomes pretty farcical when you realise they are still allowed to use it for 4G (and indeed most 5G configurations bands 4G+5G signals together), and they are used in nearly every single fibre to the cabinet deployment (and at least some of the newer FTTH). It's clearly political. If it was a real threat then they'd be forcing operators to throw at all Huawei equipment, OR banning future installs, but at getting them to trash just 5G equipment is a political stunt, IMO.
- ixfo 5y ago
  Openreach in the UK are deploying 0% new Huawei for FTTP and have basically stopped using them for FTTC because of the 30% rule. EE still use Huawei for new 5G deployments - but only in the access leg and for no more than 30% of their new builds. They've already forced removal from core/security-critical roles, but that takes serious time to actually implement.
- nradov 5y ago
  Carriers will begin decommissioning their 4G networks in the next few years to cut operating costs and free up spectrum.
  - martinald 5y ago
    They really won't. 2G is going very strong, and 3G is maybe getting shut down in next couple of years. 4G will be the primary access technology for at least 10 years and probably longer. If this is such a big security problem then surely 10+ years is an unacceptable amount of time to have potentially compromised equipment in the supply chain?
    - teruakohatu 5y ago
      Which country are you in? Here in New Zealand only one network still has 2G and they are threatening to shut it down. 3G won't be far behind.
- inkyoto 5y ago
  > This becomes pretty farcical when you realise they are still allowed to use it for 4G (and indeed most 5G configurations bands 4G+5G signals together) No, it is not a purely political farce. There is a fundamental architectural difference (that amounts to a technical one as well) that translates into a reason why 4G deployments are more «secure» as opposed to 5G deployments. Unlike in 4G, where the data that is tunneled through the core network is always encrypted, 5G allows for encrypted tunnels to get terminated near 5G base stations to enable the mobile edge computing amongst other reasons. Server equipment that is deployed at the 5G base station site then can take an advantage of the substantially decreased latency for latency sensitive workloads (ehrm, 5G enabled Doom/Quake, anyone?). AWS have a product, Wavelength, that does precisely that, and I am pretty confident there are other telcos/products doing the same. 4G, on the other hand, never terminates encrypted tunnels and passes them through the core network unchanged. Therefore, retaining the potentially compromised 4G core network equipment alongside the 5G one is somewhat «safer» – in the sense that at least the unencrypted email etc traffic won't leak out. Especially considering that 4G is on the way out (medium to long term), hence there is no need to rush and start pouring massive amounts of money into replacing/decommissioning the 4G equipment now, although it might speed up the demise of 4G in the UK and other countries.
  - martinald 5y ago
    But if the 4G equipment doing the encrypting tunneling at both ends is potentially compromised how does that encryption help? Also, nearly everything is HTTPS these days so I still don't see a massive attack vector here (at least one that wouldn't be spotted immediately like MITMing TLS connections). I think the much greater "threat" rather than messing round with traffic itself is just to shut down masses of the towers and core networks remotely. In that case, switching off 4G would be way worse as (at least in the UK) all networks doing 5G require a 4G signal as well to bond against. So having separate 5G equipment wouldn't help one iota if the 4G stuff is down.
    - inkyoto 5y ago
      > But if the 4G equipment doing the encrypting tunneling at both ends is potentially compromised how does that encryption help? The major attack vector for the compromised 4G equipment is the remote deactivation (or a wipeout or both) of it by an adversary. Breaking the encryption on the fly for volumes of traffic traversing mobile core networks is still technologically challenging. Hence the plain text communication can still be considered somewhat protected.
- varispeed 5y ago
  > It's clearly political. Is that an euphemism for corruption? It's almost certain hands were greased. That however seem to have been aligned with many interests, also of those who are supposed to protect us, but nevertheless it's worrying that there is no investigation of any kind.
  - martinald 5y ago
    No. The 5G part does not make any sense, but I think politicians think that 5G is some all seeing dancing future (it isn't, it's a marginal improvement over 4G) that must be secured at all costs.
- nonethewiser 5y ago
  >It's clearly political. If it was a real threat then they'd be forcing operators to throw at all Huawei equipment You vastly overestimate the competence of government.
  - GekkePrutser 5y ago
    Well not just that. If the government mandates all Huawei equipment to be thrown out, the providers will go to court and the government will most likely end up paying for it. In the middle of a global pandemic and resulting supply chain crisis, a rapidly intensifying fight against climate change and other expensive issues it's probably not a great idea to throw more billions away. Of course it could be a risk but it can be mitigated in other ways like multiple layers of encryption. That's never a bad idea anyway.
deepVoid 5y ago
To begin, I am not pro-Huawei or pro-China. I am just trying to make an impartial point. While the US can ban Huawei using the national security excuses, the other countries and regions such as Canada, UK, and European countries, South Korea, and Japan can use the same logic to ban American tech companies such as Intel, Microsoft, Google, Facebook etc. with the same national security reason, given that the US has spied on Germany and other European countries as well [1]. The other countries simply cannot afford to have their core infrastructure to be controlled by American tech giants. It does not bode well for American tech industry if the US closes its door and bans Huawei. The US only has more to lose if it goes down that route. [1] https://www.reuters.com/world/europe/us-security-agency-spied-merkel-other-top-european-officials-through-danish-2021-05-30/ https://www.reuters.com/world/europe/us-security-agency-spie...
ClumsyPilot 5y ago
"There is no practical way to 100% ensure that every piece of software, and every chip, in every piece of equipment is clean" If we really cared about security and reliabilty, all critical infrastructure would be open source, both software and hardware, so that multiple suppliers could produce the parts. Instead we choose 'free market' with a thumb on the scale. This does nothing to protect from random hackers and criminals, ignorance, sloppyness and lazyness.
- titzer 5y ago
  I agree 100%. But we don't really care about security and reliability. The political system is both corrupt and poorly incentivized. It doesn't reward robustness, but saving money on paper while really, truly, funneling money to cronies[1]. [1] Corruption doesn't look like mobster movies. It's mostly backyard barbecues, buddies helping their buddies' business grow by throwing them a bone. At so many different scales.
  - dexterous 5y ago
    Like I've always said, if there's something to be learned about society, you'll learn it in Star Trek. "Mr. Worf, villains who twirl their mustaches are easy to spot. Those who clothe themselves in good deeds are well-camouflaged." - Picard and Worf, discussing both the investigations and the misguidedness of Admiral Satie Season 4 Episode 21 The Drumhead https://memory-alpha.fandom.com/wiki/The_Drumhead_(episode)#Memorable_quotes https://memory-alpha.fandom.com/wiki/The_Drumhead_(episode)#...
- skinner927 5y ago
  There’s really no way to ever be 100% sure of hardware. Sure we could use FPGAs for all hardware and then the hardware “source” is software, but who makes the FPGAs? There’s techniques even under X-ray to mask a rogue chip. https://youtu.be/Hzb37RyagCQ https://youtu.be/Hzb37RyagCQ
  - ClumsyPilot 5y ago
    Are you 100% sure of anything? That there aren't any NSA employees bribed by the CPP? Just like Chelsea Manning and Snowden took gigabytes of confidential information right from under the US government nose, they could do the same without any elaborate techniques. Soviet spies were very successful and stole atomic bomb secrets. But let's suppose everyone working for the government or subcontracted by them is 100% loyal and CCP never manages to blackmail them. What does it take to bribe a DPD guy on minimum wage delivering your 'American produced' equipment, who can't afford a dentist and is in pain every day? Let's say you ask him to 'mistake' one package for another, and have millions at your disposal? You talk about "techniques even under X-ray to mask a rogue chip", but do network operators even bother opening the casing of the router to validate the motherboard has not been replaced entirely? What if it's networking equipment where China replaced a single chip, who is ever going to find out? Does the network operator validate firmware of every single chip? We have security holes all over the place, this talk of 100% certainty is basically fantasy.
PKop 5y ago
>my guess is it originated with people that weren't thinking at all about politics How is everything you just described not "politics"? In fact it is the epitome of political action, and this doesn't make it of lower quality thinking. China has been identified as geopolitical adversary, and all decisions flow from that distinction. "The specific political distinction to which political actions and motives can be reduced is that between friend and enemy." - Carl Schmitt They took what had been viewed as simply a free market, or technology, or economic competition and applied "politics" to it.
- parsimo2010 5y ago
  I’m pretty sure GP meant that whoever in the USA started the push to eliminate Huawei equipment wasn’t thinking in terms of American party politics- as in, this didn’t arise during the Trump administration because Trump wanted to look tough on China, it arose because some American government researcher discovered some backdoors when Trump happened to be president. The whistle was blown not to give one party an edge out talking point, but because the researcher wanted to help their country. So political in the USA vs. China sense, but not political in the commonly used Republicans vs Democrats sense.
jweir 5y ago
This story is much older than the Trump admin. Here is 2012 story from the Economist – Who’s afraid of Huawei? https://www.economist.com/leaders/2012/08/04/whos-afraid-of-huawei https://www.economist.com/leaders/2012/08/04/whos-afraid-of-...
gary_0 5y ago
> is about more than just supply chain And the supply chain issues alone are alarming enough, if your high-tech military (and its vast civilian tributaries) rely on chip factories within easy bombing distance of your largest geopolitical competitor.
DevKoala 5y ago
> The way the last administration rolled this out was certainly with a political narrative, but my guess is it originated with people that weren't thinking at all about politics. During the last administration there were multiple reports of Huawei hardware containing backdoors, which were originally criticized by the mass media; a Bloomberg piece comes to mind. I don’t think that the political nature of the initiative has changed at all. It has always been about national security.
Cullinet 5y ago
I understand that the most serious and unrecognised problem is the wholesale outsourcing of network infrastructure to vendors, down to single digit head office teams in certain European operators.

deleted 5y ago

[deleted]

martinald 5y ago

I don't know exactly the US story, but the UK has forced operators to remove "5G" huawei equipment. This becomes pretty farcical when you realise they are still allowed to use it for 4G (and indeed most 5G configurations bands 4G+5G signals together), and they are used in nearly every single fibre to the cabinet deployment (and at least some of the newer FTTH). It's clearly political. If it was a real threat then they'd be forcing operators to throw at all Huawei equipment, OR banning future installs, but at getting them to trash just 5G equipment is a political stunt, IMO.

ixfo 5y ago
Openreach in the UK are deploying 0% new Huawei for FTTP and have basically stopped using them for FTTC because of the 30% rule. EE still use Huawei for new 5G deployments - but only in the access leg and for no more than 30% of their new builds. They've already forced removal from core/security-critical roles, but that takes serious time to actually implement.
nradov 5y ago
Carriers will begin decommissioning their 4G networks in the next few years to cut operating costs and free up spectrum.
- martinald 5y ago
  They really won't. 2G is going very strong, and 3G is maybe getting shut down in next couple of years. 4G will be the primary access technology for at least 10 years and probably longer. If this is such a big security problem then surely 10+ years is an unacceptable amount of time to have potentially compromised equipment in the supply chain?
  - teruakohatu 5y ago
    Which country are you in? Here in New Zealand only one network still has 2G and they are threatening to shut it down. 3G won't be far behind.
inkyoto 5y ago
> This becomes pretty farcical when you realise they are still allowed to use it for 4G (and indeed most 5G configurations bands 4G+5G signals together) No, it is not a purely political farce. There is a fundamental architectural difference (that amounts to a technical one as well) that translates into a reason why 4G deployments are more «secure» as opposed to 5G deployments. Unlike in 4G, where the data that is tunneled through the core network is always encrypted, 5G allows for encrypted tunnels to get terminated near 5G base stations to enable the mobile edge computing amongst other reasons. Server equipment that is deployed at the 5G base station site then can take an advantage of the substantially decreased latency for latency sensitive workloads (ehrm, 5G enabled Doom/Quake, anyone?). AWS have a product, Wavelength, that does precisely that, and I am pretty confident there are other telcos/products doing the same. 4G, on the other hand, never terminates encrypted tunnels and passes them through the core network unchanged. Therefore, retaining the potentially compromised 4G core network equipment alongside the 5G one is somewhat «safer» – in the sense that at least the unencrypted email etc traffic won't leak out. Especially considering that 4G is on the way out (medium to long term), hence there is no need to rush and start pouring massive amounts of money into replacing/decommissioning the 4G equipment now, although it might speed up the demise of 4G in the UK and other countries.
- martinald 5y ago
  But if the 4G equipment doing the encrypting tunneling at both ends is potentially compromised how does that encryption help? Also, nearly everything is HTTPS these days so I still don't see a massive attack vector here (at least one that wouldn't be spotted immediately like MITMing TLS connections). I think the much greater "threat" rather than messing round with traffic itself is just to shut down masses of the towers and core networks remotely. In that case, switching off 4G would be way worse as (at least in the UK) all networks doing 5G require a 4G signal as well to bond against. So having separate 5G equipment wouldn't help one iota if the 4G stuff is down.
  - inkyoto 5y ago
    > But if the 4G equipment doing the encrypting tunneling at both ends is potentially compromised how does that encryption help? The major attack vector for the compromised 4G equipment is the remote deactivation (or a wipeout or both) of it by an adversary. Breaking the encryption on the fly for volumes of traffic traversing mobile core networks is still technologically challenging. Hence the plain text communication can still be considered somewhat protected.
varispeed 5y ago
> It's clearly political. Is that an euphemism for corruption? It's almost certain hands were greased. That however seem to have been aligned with many interests, also of those who are supposed to protect us, but nevertheless it's worrying that there is no investigation of any kind.
- martinald 5y ago
  No. The 5G part does not make any sense, but I think politicians think that 5G is some all seeing dancing future (it isn't, it's a marginal improvement over 4G) that must be secured at all costs.
nonethewiser 5y ago
>It's clearly political. If it was a real threat then they'd be forcing operators to throw at all Huawei equipment You vastly overestimate the competence of government.
- GekkePrutser 5y ago
  Well not just that. If the government mandates all Huawei equipment to be thrown out, the providers will go to court and the government will most likely end up paying for it. In the middle of a global pandemic and resulting supply chain crisis, a rapidly intensifying fight against climate change and other expensive issues it's probably not a great idea to throw more billions away. Of course it could be a risk but it can be mitigated in other ways like multiple layers of encryption. That's never a bad idea anyway.

deepVoid 5y ago

To begin, I am not pro-Huawei or pro-China. I am just trying to make an impartial point. While the US can ban Huawei using the national security excuses, the other countries and regions such as Canada, UK, and European countries, South Korea, and Japan can use the same logic to ban American tech companies such as Intel, Microsoft, Google, Facebook etc. with the same national security reason, given that the US has spied on Germany and other European countries as well [1]. The other countries simply cannot afford to have their core infrastructure to be controlled by American tech giants. It does not bode well for American tech industry if the US closes its door and bans Huawei. The US only has more to lose if it goes down that route. [1] https://www.reuters.com/world/europe/us-security-agency-spied-merkel-other-top-european-officials-through-danish-2021-05-30/ https://www.reuters.com/world/europe/us-security-agency-spie...

ClumsyPilot 5y ago

"There is no practical way to 100% ensure that every piece of software, and every chip, in every piece of equipment is clean" If we really cared about security and reliabilty, all critical infrastructure would be open source, both software and hardware, so that multiple suppliers could produce the parts. Instead we choose 'free market' with a thumb on the scale. This does nothing to protect from random hackers and criminals, ignorance, sloppyness and lazyness.

titzer 5y ago
I agree 100%. But we don't really care about security and reliability. The political system is both corrupt and poorly incentivized. It doesn't reward robustness, but saving money on paper while really, truly, funneling money to cronies[1]. [1] Corruption doesn't look like mobster movies. It's mostly backyard barbecues, buddies helping their buddies' business grow by throwing them a bone. At so many different scales.
- dexterous 5y ago
  Like I've always said, if there's something to be learned about society, you'll learn it in Star Trek. "Mr. Worf, villains who twirl their mustaches are easy to spot. Those who clothe themselves in good deeds are well-camouflaged." - Picard and Worf, discussing both the investigations and the misguidedness of Admiral Satie Season 4 Episode 21 The Drumhead https://memory-alpha.fandom.com/wiki/The_Drumhead_(episode)#Memorable_quotes https://memory-alpha.fandom.com/wiki/The_Drumhead_(episode)#...
skinner927 5y ago
There’s really no way to ever be 100% sure of hardware. Sure we could use FPGAs for all hardware and then the hardware “source” is software, but who makes the FPGAs? There’s techniques even under X-ray to mask a rogue chip. https://youtu.be/Hzb37RyagCQ https://youtu.be/Hzb37RyagCQ
- ClumsyPilot 5y ago
  Are you 100% sure of anything? That there aren't any NSA employees bribed by the CPP? Just like Chelsea Manning and Snowden took gigabytes of confidential information right from under the US government nose, they could do the same without any elaborate techniques. Soviet spies were very successful and stole atomic bomb secrets. But let's suppose everyone working for the government or subcontracted by them is 100% loyal and CCP never manages to blackmail them. What does it take to bribe a DPD guy on minimum wage delivering your 'American produced' equipment, who can't afford a dentist and is in pain every day? Let's say you ask him to 'mistake' one package for another, and have millions at your disposal? You talk about "techniques even under X-ray to mask a rogue chip", but do network operators even bother opening the casing of the router to validate the motherboard has not been replaced entirely? What if it's networking equipment where China replaced a single chip, who is ever going to find out? Does the network operator validate firmware of every single chip? We have security holes all over the place, this talk of 100% certainty is basically fantasy.

PKop 5y ago

>my guess is it originated with people that weren't thinking at all about politics How is everything you just described not "politics"? In fact it is the epitome of political action, and this doesn't make it of lower quality thinking. China has been identified as geopolitical adversary, and all decisions flow from that distinction. "The specific political distinction to which political actions and motives can be reduced is that between friend and enemy." - Carl Schmitt They took what had been viewed as simply a free market, or technology, or economic competition and applied "politics" to it.

parsimo2010 5y ago
I’m pretty sure GP meant that whoever in the USA started the push to eliminate Huawei equipment wasn’t thinking in terms of American party politics- as in, this didn’t arise during the Trump administration because Trump wanted to look tough on China, it arose because some American government researcher discovered some backdoors when Trump happened to be president. The whistle was blown not to give one party an edge out talking point, but because the researcher wanted to help their country. So political in the USA vs. China sense, but not political in the commonly used Republicans vs Democrats sense.

jweir 5y ago

This story is much older than the Trump admin. Here is 2012 story from the Economist – Who’s afraid of Huawei? https://www.economist.com/leaders/2012/08/04/whos-afraid-of-huawei https://www.economist.com/leaders/2012/08/04/whos-afraid-of-...

gary_0 5y ago

> is about more than just supply chain And the supply chain issues alone are alarming enough, if your high-tech military (and its vast civilian tributaries) rely on chip factories within easy bombing distance of your largest geopolitical competitor.

DevKoala 5y ago

> The way the last administration rolled this out was certainly with a political narrative, but my guess is it originated with people that weren't thinking at all about politics. During the last administration there were multiple reports of Huawei hardware containing backdoors, which were originally criticized by the mass media; a Bloomberg piece comes to mind. I don’t think that the political nature of the initiative has changed at all. It has always been about national security.

Cullinet 5y ago

I understand that the most serious and unrecognised problem is the wholesale outsourcing of network infrastructure to vendors, down to single digit head office teams in certain European operators.