7 ms·

I would be extremely surprised if a state-actor like China couldn’t access most US company data at will. If you can invest several billions and have thousands o

I would be extremely surprised if a state-actor like China couldn’t access most US company data at will. If you can invest several billions and have thousands of people working to create a breach, no company is safe, not even AWS or Microsoft. In this case, that’s even way easier, the company is Chinese, the CCP can have this access lawfully, is this something unexpected? I’m much more concerned by the laziness of most western governments in understanding if this was a threat or not.

burnished 3y ago
I think their repeat public position was that the CCP could not have law access and did not have access. I don't think anyone believed it, but still
- Haga 3y ago
  [dead]
pydry 3y ago
I would have been unsurprised if the US government hadn't already forced them to host with Oracle a year or two ago supposedly to prevent exactly this from happening. Is Larry Ellison a Chinese spy? He would probably have to either be complicit or criminally negligent to allow this to happen given he was given the contract precisely for this reason. I'm also reminded of that fake story from the WSJ about American chips being hacked that turned out to be entirely fabricated. And US insistence that "dumb" 5g aerials already vetted by national security agencies had to be banned (along with kit that was absolutely a legitimate risk) because they could potentially possibly harbor listening devices maybe.
- rightbyte 3y ago
  > I'm also reminded of that fake story from the WSJ about American chips being hacked Unless there is hard proof of anything I always assume news like these is the usual suspects warmongering.
- aardvarkr 3y ago
  Hosting with oracle doesn’t change a thing. Just because the data would be on US servers don’t stop the data from being accessible from outside of the region. And is it really that hard to imagine a world where a hostile and ambitious nation would seek to leverage a technology platform to listen to sensitive conversations? The US has done it in the past and you better believe China will be doing it too.
  - pydry 3y ago
    >Hosting with oracle doesn’t change a thing So when the US government made a song and dance 18 months ago about why it was absolutely critical that it be done to protect against exactly this threat you think they were lying or staggeringly incompetent? And this time they're totally not?
    - shrimp_emoji 3y ago
      It's better than not hosting the data in friendly or neutral turf, but you're trusting a U.S. company (Oracle) to somehow some way mitigate Chinese surveillance and algorithmic manipulation. Erecting an industrial complex dedicated to a poorly-defined and probably impossible anti-China mission on a Chinese-controlled platform, run by entities that salivate at Chinese $$$, doesn't seem like the best idea.
    - Dylan16807 3y ago
      I thought it was a pretty dumb measure. What do you mean "this time"? I just see a personal lawsuit? But if the government did say the chinese government still has access, I don't think there would be much reason to disbelieve them. If the government claims there is a problem, and then a (possibly halfassed) attempt to fix it happens, and then the government claims the problem still exists... there is some credibility lost on the "fixing" front but the "problem exists" front is likely still credible. Especially if the different parts of that saga are coming from different parts of the government.
- WillPostForFood 3y ago
  I would have been unsurprised if the US government hadn't already forced them to host with Oracle a year or two ago supposedly to prevent exactly this from happening. The allegations are from 2017-18 when the guy was fired. The migration of user data was last year, but it is not like they are disconnected from China I'm also reminded of that fake story from the WSJ about American chips being hacked that turned out to be entirely fabricated. It was a 2018 Bloomberg story. Bloomberg still refuses to admit they were wrong, and doubled down in 2021. That no "tiny chips" have turned up yet should be near definitive proof that story was bogus.
- Kadin 3y ago
  Forcing ByteDance to host the data in the US, on Oracle's servers or anyone else's, doesn't mean a lot if there are a bunch of people in China with the login to those servers. Who has access to the data and the various administrative controls over it are more important than where it physically resides. ByteDance has claimed that their US operations were administratively firewalled from their Chinese ones, and then it's been repeatedly shown not to be the case. At this point they have lost all credibility about their ability to 'firewall' or internally control access to user data, probably because they (or certain parts of the company) don't really want to.
- lazyeye 3y ago
  The article is talking about the Chinese govt.
- barbecue_sauce 3y ago
  > I'm also reminded of that fake story from the WSJ about American chips being hacked that turned out to be entirely fabricated. Bloomberg, not WSJ.
VWWHFSfQ 3y ago
> the laziness of most western governments in understanding if this was a threat or not I think USA recognized the threat very early on. It's been a hot-button topic for several years. Remember when the Trump administration tried to force a sale of ByteDance's USA operations to Microsoft? And even now the apps and services are blocked on US government devices and networks. And even at a lot of public universities. The concern is there. I don't think it's laziness.
Kadin 3y ago
The Chinese government, like the US government or any other large national government, is not monolithic. Having information available for easy perusal via a commercial channel (which is potentially not even illegal) is very different from having information accessible via use of national-asset intelligence capabilities. Information which can only be obtained the second way is almost certainly going to receive different treatment than the first. There is value in making information more difficult (and more illegal, and less socially and politically acceptable) to access, even if that control is not 100% effective or if there are still ways of getting around it. Increasing the friction involved in accessing personal information is an imperfect win, but a win nonetheless. For most users of commercial software, your system is penetrable and should be considered insecure against a nation-state level attacker willing to spend a 0-day on getting in. But that doesn't mean you should just leave everything hanging out in the open where any doofus can get to it, or voluntarily hand your information over to an unfriendly government's partner corporation. At least make them work for it.
- nova22033 3y ago
  The Chinese government, like the US government or any other large national government, is not monolithic. In what meaningful way does one part of the Chinese government differ from another part of the Chinese government? Isn't Xi basically the supreme leader for life now?
  - orbz 3y ago
    Even assuming he is the supreme leader, he can’t be everywhere, know everything and oversee all aspects of the regime. Every sufficiently large organization, such as a government, has delegated areas of responsibility to various sub organizations. Those scopes will have varying overlap with other sub organizations, where it will result in political battles. It is more like competing microservices than monolith.
  - junofan 3y ago
    Nah they a couple different factions. Shanghai is different from Beijing for example.
samstave 3y ago
Imagine the worms put on phones of employees of various tech companies - specifically datacenter employees in various commerical and government agencies - recall the STRAVA scandal which revealed secret military bases... The TikTok angle is like stuxnet for that type of corporate/gov espionage.... Its ludicris how poorly the USG has handled this. But then again, you have so many people in congress with dual citizenship (which should be illegal and a capital crime IMO) but then look at the spouses of lawmakers, their investments, their citizenship, their network ranking over the time their spouce was in congress, and their kids... FFS we are still arguing over Biden's ties to money laundering in Ukraine and China, but we dont talk about the GOAT of grifters ; Mitch McConnell? the CCP has more backdoors into the USG than they do with just TikTok ... and lets not even talk about Israel's backdoors which are actually a front-door-fire-hose.
- Kadin 3y ago
  The US government is and has always been reactive, not proactive. About the most forward-thinking the US gets is writing the occasional contingency plan. Everything else is done in haste once a serious problem becomes plainly obvious to everyone, and people (deep-pocketed ones especially) start screaming to their elected representatives to fucking do something about it. Then and only then do the gears start to turn.
- Dylan16807 3y ago
  If you want dual citizens to be ineligible for congress then just do that, it doesn't have to be a crime...
  - samstave 3y ago
    [flagged]
    - dang 3y ago
      Sam - we've been asking you for years not to break the site guidelines, let alone this badly. We've cut you as much slack as anyone in the history of this site. I don't want to ban you but the slack is definitely going to run out someday. No more, please. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
stale2002 3y ago
> the CCP can have this access lawfully, is this something unexpected Oh it is completely expected. People have been warning about TikTok for years, and yet those people get called crazy. The US should have taken action against them years ago. We can still fix the issue now though, by creating a targeted law against them.
- Kadin 3y ago
  > We can still fix the issue now though, by creating a targeted law against them. That's not a great idea, since it will invite a lawsuit on the (potentially valid) grounds that it's a de facto bill of attainder. Which the US has traditionally taken a dim view on for very good reasons. Better would be if it prompted a more general law about foreign ownership of corporations which have access to large amounts of information on US persons, regardless of how it is obtained or who they are. As a US citizen, I don't want any government that I don't have input into -- even the relatively indirect and less-than-satisfying input of casting one vote among millions -- compiling a dossier on me, and I expect my government to do what it can to make that at least somewhat difficult. (And yes, I am aware there is no way to stop it completely. If the Chinese government wants to task its intelligence service to compile a dossier on me, there's nothing much that can be done about it. But let's at least try to raise the bar on the difficulty and effort involved. The more difficult and expensive, the more illegal, and the more internationally frowned-upon the task becomes, the harder it is to do at scale to millions or billions of people at once.)
  - stale2002 3y ago
    > a more general law about foreign ownership of corporations Sure make it targeted against large scale companies owned by china, or "owned by countries on this specific government list, which happens to only include china and a few of our other enemies, like Russia". Same thing, and we are more than able to get away with it, even though it is basically just targeted at TikTok.
    - lazyeye 3y ago
      I dont know why it has to be complicated. Just block all apps from countries that already block all yours.
_8j50 3y ago
It doesn't even have to be a state actor but it isn't as simple as "at will" a compromise requires effort and resources and discovery would be attributed back to the actor. Willful access has none of that problem.
fuzzfactor 3y ago
Didn't that seem to be the purpose of tiktok to begin with?
berjin 3y ago
Even if the tech is secure there are still thousands of foreign employees working in those companies. It's not uncommon for people to be sympathisers of their homeland. And it's not symmetrical since very few westerners work for Alibaba, Huawei etc.

burnished 3y ago

I think their repeat public position was that the CCP could not have law access and did not have access. I don't think anyone believed it, but still

Haga 3y ago
[dead]

pydry 3y ago

I would have been unsurprised if the US government hadn't already forced them to host with Oracle a year or two ago supposedly to prevent exactly this from happening. Is Larry Ellison a Chinese spy? He would probably have to either be complicit or criminally negligent to allow this to happen given he was given the contract precisely for this reason. I'm also reminded of that fake story from the WSJ about American chips being hacked that turned out to be entirely fabricated. And US insistence that "dumb" 5g aerials already vetted by national security agencies had to be banned (along with kit that was absolutely a legitimate risk) because they could potentially possibly harbor listening devices maybe.

rightbyte 3y ago
> I'm also reminded of that fake story from the WSJ about American chips being hacked Unless there is hard proof of anything I always assume news like these is the usual suspects warmongering.
aardvarkr 3y ago
Hosting with oracle doesn’t change a thing. Just because the data would be on US servers don’t stop the data from being accessible from outside of the region. And is it really that hard to imagine a world where a hostile and ambitious nation would seek to leverage a technology platform to listen to sensitive conversations? The US has done it in the past and you better believe China will be doing it too.
- pydry 3y ago
  >Hosting with oracle doesn’t change a thing So when the US government made a song and dance 18 months ago about why it was absolutely critical that it be done to protect against exactly this threat you think they were lying or staggeringly incompetent? And this time they're totally not?
  - shrimp_emoji 3y ago
    It's better than not hosting the data in friendly or neutral turf, but you're trusting a U.S. company (Oracle) to somehow some way mitigate Chinese surveillance and algorithmic manipulation. Erecting an industrial complex dedicated to a poorly-defined and probably impossible anti-China mission on a Chinese-controlled platform, run by entities that salivate at Chinese $$$, doesn't seem like the best idea.
  - Dylan16807 3y ago
    I thought it was a pretty dumb measure. What do you mean "this time"? I just see a personal lawsuit? But if the government did say the chinese government still has access, I don't think there would be much reason to disbelieve them. If the government claims there is a problem, and then a (possibly halfassed) attempt to fix it happens, and then the government claims the problem still exists... there is some credibility lost on the "fixing" front but the "problem exists" front is likely still credible. Especially if the different parts of that saga are coming from different parts of the government.
WillPostForFood 3y ago
I would have been unsurprised if the US government hadn't already forced them to host with Oracle a year or two ago supposedly to prevent exactly this from happening. The allegations are from 2017-18 when the guy was fired. The migration of user data was last year, but it is not like they are disconnected from China I'm also reminded of that fake story from the WSJ about American chips being hacked that turned out to be entirely fabricated. It was a 2018 Bloomberg story. Bloomberg still refuses to admit they were wrong, and doubled down in 2021. That no "tiny chips" have turned up yet should be near definitive proof that story was bogus.
Kadin 3y ago
Forcing ByteDance to host the data in the US, on Oracle's servers or anyone else's, doesn't mean a lot if there are a bunch of people in China with the login to those servers. Who has access to the data and the various administrative controls over it are more important than where it physically resides. ByteDance has claimed that their US operations were administratively firewalled from their Chinese ones, and then it's been repeatedly shown not to be the case. At this point they have lost all credibility about their ability to 'firewall' or internally control access to user data, probably because they (or certain parts of the company) don't really want to.
lazyeye 3y ago
The article is talking about the Chinese govt.
barbecue_sauce 3y ago
> I'm also reminded of that fake story from the WSJ about American chips being hacked that turned out to be entirely fabricated. Bloomberg, not WSJ.

VWWHFSfQ 3y ago

> the laziness of most western governments in understanding if this was a threat or not I think USA recognized the threat very early on. It's been a hot-button topic for several years. Remember when the Trump administration tried to force a sale of ByteDance's USA operations to Microsoft? And even now the apps and services are blocked on US government devices and networks. And even at a lot of public universities. The concern is there. I don't think it's laziness.

Kadin 3y ago

The Chinese government, like the US government or any other large national government, is not monolithic. Having information available for easy perusal via a commercial channel (which is potentially not even illegal) is very different from having information accessible via use of national-asset intelligence capabilities. Information which can only be obtained the second way is almost certainly going to receive different treatment than the first. There is value in making information more difficult (and more illegal, and less socially and politically acceptable) to access, even if that control is not 100% effective or if there are still ways of getting around it. Increasing the friction involved in accessing personal information is an imperfect win, but a win nonetheless. For most users of commercial software, your system is penetrable and should be considered insecure against a nation-state level attacker willing to spend a 0-day on getting in. But that doesn't mean you should just leave everything hanging out in the open where any doofus can get to it, or voluntarily hand your information over to an unfriendly government's partner corporation. At least make them work for it.

nova22033 3y ago
The Chinese government, like the US government or any other large national government, is not monolithic. In what meaningful way does one part of the Chinese government differ from another part of the Chinese government? Isn't Xi basically the supreme leader for life now?
- orbz 3y ago
  Even assuming he is the supreme leader, he can’t be everywhere, know everything and oversee all aspects of the regime. Every sufficiently large organization, such as a government, has delegated areas of responsibility to various sub organizations. Those scopes will have varying overlap with other sub organizations, where it will result in political battles. It is more like competing microservices than monolith.
- junofan 3y ago
  Nah they a couple different factions. Shanghai is different from Beijing for example.

samstave 3y ago

Imagine the worms put on phones of employees of various tech companies - specifically datacenter employees in various commerical and government agencies - recall the STRAVA scandal which revealed secret military bases... The TikTok angle is like stuxnet for that type of corporate/gov espionage.... Its ludicris how poorly the USG has handled this. But then again, you have so many people in congress with dual citizenship (which should be illegal and a capital crime IMO) but then look at the spouses of lawmakers, their investments, their citizenship, their network ranking over the time their spouce was in congress, and their kids... FFS we are still arguing over Biden's ties to money laundering in Ukraine and China, but we dont talk about the GOAT of grifters ; Mitch McConnell? the CCP has more backdoors into the USG than they do with just TikTok ... and lets not even talk about Israel's backdoors which are actually a front-door-fire-hose.

Kadin 3y ago
The US government is and has always been reactive, not proactive. About the most forward-thinking the US gets is writing the occasional contingency plan. Everything else is done in haste once a serious problem becomes plainly obvious to everyone, and people (deep-pocketed ones especially) start screaming to their elected representatives to fucking do something about it. Then and only then do the gears start to turn.
Dylan16807 3y ago
If you want dual citizens to be ineligible for congress then just do that, it doesn't have to be a crime...
- samstave 3y ago
  [flagged]
  - dang 3y ago
    Sam - we've been asking you for years not to break the site guidelines, let alone this badly. We've cut you as much slack as anyone in the history of this site. I don't want to ban you but the slack is definitely going to run out someday. No more, please. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

stale2002 3y ago

> the CCP can have this access lawfully, is this something unexpected Oh it is completely expected. People have been warning about TikTok for years, and yet those people get called crazy. The US should have taken action against them years ago. We can still fix the issue now though, by creating a targeted law against them.

Kadin 3y ago
> We can still fix the issue now though, by creating a targeted law against them. That's not a great idea, since it will invite a lawsuit on the (potentially valid) grounds that it's a de facto bill of attainder. Which the US has traditionally taken a dim view on for very good reasons. Better would be if it prompted a more general law about foreign ownership of corporations which have access to large amounts of information on US persons, regardless of how it is obtained or who they are. As a US citizen, I don't want any government that I don't have input into -- even the relatively indirect and less-than-satisfying input of casting one vote among millions -- compiling a dossier on me, and I expect my government to do what it can to make that at least somewhat difficult. (And yes, I am aware there is no way to stop it completely. If the Chinese government wants to task its intelligence service to compile a dossier on me, there's nothing much that can be done about it. But let's at least try to raise the bar on the difficulty and effort involved. The more difficult and expensive, the more illegal, and the more internationally frowned-upon the task becomes, the harder it is to do at scale to millions or billions of people at once.)
- stale2002 3y ago
  > a more general law about foreign ownership of corporations Sure make it targeted against large scale companies owned by china, or "owned by countries on this specific government list, which happens to only include china and a few of our other enemies, like Russia". Same thing, and we are more than able to get away with it, even though it is basically just targeted at TikTok.
  - lazyeye 3y ago
    I dont know why it has to be complicated. Just block all apps from countries that already block all yours.

_8j50 3y ago

It doesn't even have to be a state actor but it isn't as simple as "at will" a compromise requires effort and resources and discovery would be attributed back to the actor. Willful access has none of that problem.

fuzzfactor 3y ago

Didn't that seem to be the purpose of tiktok to begin with?

berjin 3y ago

Even if the tech is secure there are still thousands of foreign employees working in those companies. It's not uncommon for people to be sympathisers of their homeland. And it's not symmetrical since very few westerners work for Alibaba, Huawei etc.