Slashdot Mirror
India, China Try Import Regulations As Security Tools
An anonymous reader writes "The Register reports that the Chinese government is forcing vendors to cough up the source code to their encryption alogrithms before they can sell their equipment to the Chinese government. The EU doesn't seem to like it, but if I were in their position I'd want the same thing."
China's biggest neighbor goes further; another anonymous reader writes "Telco equipment from China could have spyware that gives access to telcom networks in India. The Indian government has officially told mobile operators not to import any equipment manufactured by Chinese vendors, including Huawei and ZTE. The ban order follows concerns raised by the Home Ministry that telecom equipment from some countries could have spyware or malware that gives intelligence agencies across the border access to telecom networks in India. The biggest gainers from the move could be Ericsson, Nokia, and Siemens, which have been losing market share to aggressive Chinese equipment-makers in India."
are the ones that are open to peer review. So Kudos to the Chinese for being smart enough to make these idiot companies with closed-source encryption technologies provide them with the source code for review. Good encryption does not rely on obfuscation of code and processes!
Did you ever wake up in the morning, with a Zombie Woof behind your eyes? -- FZ
If I am buying encryption software I too would like assurance that it is not filled with back doors.
This seems like a natural progression down the line of diminishing trust between countries. It's not very surprising, especially since the Chinese government *may* have been 'supportive' of some of the China/Google hacking. It appears the downside of possibly endorsing or supporting security breaches is other people/countries/etc will suspect you of it from that point on.
... and I can't blame India for not trusting Chinese technology. Nobody wins when no one trusts each other.
I can't blame the Chinese government for wanting to have the encryption information
If you're going to give your source code to the Chinese, you know for certain they will copy it and never buy a product from you again.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Security through security!
Set your phasers on "funky"!
... will your wonders never cease?
That is all.
Good move by India. Now, US and EU should ban chinese junk like Huawei, ZTE etc.
Unless the source can be compiled from scratch and used in place of the pre-compiled versions, including flashing of firmware, creation of installable ROM images or OS installs, having source code guaranteed by analysis to be exploit-free gains the user nothing. There could still be spyware in the final product. Short of self-installing, I guess creation of bit-equivalent or checksum-equivalent binaries would be good enough as a verification mechanism.
I wonder how the fact that India and China went to war in 1962 impacts these decisions. They also still share a disputed border.
Would not surprise me if this influences how the Indian government feels about their telecoms using equipment from ZTE or Huawei.
I know not what course others may take; but as for me, give me liberty or give me death!
Yes, India is, like, right now in the process of auctioning 3G licenses. This will really bring benefits to Ericsson and Nokia Siemens.
One that hath name thou can not otter
I think China's move makes sense - they just want to check and make sure there is no backdoor in your code/algo. As an earlier post said "Good encryption does not rely on obfuscation of code and processes." They trust what the users want to encrypt, just making sure the devices are not leaking the info to uninvited parties.
As for India, this is very bad. They are just paranoid. This sets up a very bad example. They are scaring off all the business partners and hence the opportunities. Think if you are a vendor, how can you be sure that they would never do the same thing to you one day?
actually Alcatel-Lucent will benefit from this. They have low priced telecom equipment and they have been replaced in many countries by even cheaper Huawei.
But isn't this strange? They put a ban because chinese "could have spyware or malware" in their equipment. Isn't this like putting someone in jail because he might do something bad in the future?
Here is my conspiracy theory: big companies export corruptions in the developing countries (this is a fact). Some companies could just not compete with the cheap Huawei so they paid officials for the ban. Problem solved! either this or the chinese really have spyware on their machines.
Isn't Russia China's biggest (at least by area) neighbor, not India?
I have worked in the defense industry for a while, and used to work in the "Government" division of a major telecom company.
One project we had worked on was encrypted cell phones for gov use. Our customers were only interested in a solution that was top to bottom US made from cleared companies. The chipset, OS, drivers, etc, were all built in the US, so there was no issue of "back doors"
I also heard rumors at one point about some contractor actually finding mal-ware type SW embedded in the firmware of Lenovo laptops that could sort of call home to momma. I've never seen Lenovo boxes around after that.
I think these issues are going to be bigger than just a single point in the infrastructure chain. With so much cyber activity going on, I think many countries are going to face the same sort of issue India is trying to prevent.
What a coincidence! Or is it...?
First off, TFA article doesn't mention source code; second, it quite explicitly says 'details are murky' and it is unclear what the PRC is asking for. At least as far as the article goes, that is what is said.
Second, to some comments: Other countries already have various schemes in place for reviewing code (which doesn't preclude flaws or backdoors, intentional or not, from being included in compiled / embedded code...)
India is saying what other countries fear, but since they are in China's backyard and vice versa, it's not surprising they're willing to go a little further and say it out loud as well as act on it. Also, as a bit of a reminder, India and China are as much --if not more so-- in competition than US/China/Europe: India has been trying to bolster it's sea power as it falls further behind China in that regard, China has close ties with Pakistan partially because Pakistan and India don't like each other particularly much, India is courting Afghanistan partially to offset Pakistan's power, etc. And let's not forget China and India have fought an actual war, albeit a fairly small one, and India lost and has never accepted the outcome.
The idea that corporations that bowl over the largest nation states is our future has always seemed strange to me. Multinationals are really just a legal fiction that exists simultaneously in multiple countries. At any time, a political system can create problems that will effectively bring that multinational to its knees.
I think the future for big business is identical, only a little further out, to that of big government: replacement by small, agile businesses. Big business exists mainly because of big government and cooperation between the same. I think we're going to see a future in which each major country may trade for some tech products, but you'll see conditions begin to favor agile, much smaller businesses that can efficiently produce most important things at home.
The headline suggests that China is using import rules to bolster security. I think it is the other way round. They are using the demand for source code as a barrier to trade to (unfairly) help domestic firms. Not very many overseas firms are going to provide source code, leaving the market open to Chinese firms.
in the 80's and 90's American manufacturers gave away their technology to the Chinese to get a piece of the huge Chinese market. This allowed the Chinese to modernize their manufacturing technology by decades in a few years. Then instead of opening their markets, China flooded the world markets and decimated the foreign competition.
One might hope managers of corporations would learn from the past...
Go India! Everyone should ban electronics made in China given China's general proclivity towards industrial espionage.
The Christian religion has been and still is the principal enemy of moral progress in the world. -- Bertrand Russell
I think ALL governments should behave this way. If government is to take its own data security seriously, the boxes they use should not be "black boxes." For commercial business this should also be a rule but so far, business trusts closed source software and devices running on closed source software... well, not all businesses... not Ernie Ball ... not London Stock Exchange... but most businesses.
At some level, we have to trust technology though... seriously, I don't know what's in the Linux kernel. I trust that since it is peer reviewed and tested a lot that it can be trusted, but I personally and directly do not know everything in there. I don't know everything about my cars either come to think of it.... but in general, when it comes to matters of serious consequence, one is best advised to learn and understand what it going on and where the potential dangers lie.
I think India isn't doing the restrictions for Trust or Security reasons. Their politicians couldn't care less. For the right price, they will sell you a state or two.
It probably has more to do with keeping knock off China phones off the markets to keep the big corps happy. In India, there is rampant import of Chinese knockoff phones. An HTC becomes a HIC. They add a little line at the bottom and cut the price from $400 to $50. I kid you not. Quality control is an issue, but if you have the right connections, that won't be a problem. The phone is from the same factory that makes the name brand, its the same materials, same machines, and same people. Just the 3rd shift of lineman and it doesn't go through QC before shipment.
So for sometime, the India government has been pressured to put a stop to this import. They haven't been very successful but that doesn't mean they don't look like they are trying. Exactly how do you stop 50 individually owned stores stuffed into an area the size of a CVS from selling the same stuff to a population that creates a massive amount of demand but isn't willing to pay like credit based Americans are. Not to mention your enforcement divisions are willing to look the other way for a dollar of that $50 sale. Additionally, the worst offenders are the politicians and those connected to them.
It's hard to test a linux kernel build for instance, because it embeds the time of the kernel build (and other information) into the kernel binary itself.
More then anything, India is probably retaliating for China teaming up with Pakistan on nuclear technology.
EGOTIST, n. A person of low taste, more interested in himself than in me.
Nobody should be using crypto whose source code hasn't been given to the Chinese government, the Cult of Scientology, the NSA, and the National Association of Marlon Brando Lookalikes. If you're not willing to share your code with them, then it must not be very good. I sure don't wanna use any crypto code, unless some smug smirking developer has said, "Sure, the Chinese can look at it."
I picked up a lovely dirt-cheap Chinese wireless card a month ago (Tenda from Jaycar in Oz for those interested).
Upon installation, the windows kept losing focus - type-type-type.. wtf (clicked back into the window).
Thought I'd watch the network traffic a bit, and sure enough; type-type-type.. window loses focus... network traffic spikes a smidgen...
Wait! Whats a sig?
The Indian end of it looks like their simply trying to bring manufacturing plants to India soil where they can tax people and propagate the whole "technology leader" thing they've been flying for several years.
The EU doesn't like it because it will "supposedly" hurt the bottom line for telco manufacturer's based in their taxable areas which is BS. Cheaper productions costs means more profit = more taxable income for the EU.
Telco's manufacturers own the hardware and usually stipulate unrestricted access to their platforms at all times. Its in the contract and has been since Watson sold Hollerith crap to the Nazi's. Was done 60 years ago, is being done today (Avaya, Alcatel, Nokia) nothing new here.
The effect of giving the Windows source code to China seems to have been that people in China used it to break into Google and tens of other major corporations.
Come again?
You mean Google is running on Microsoft Windows' code ???
No, I ain't trying to be funny. I just can not put the 2 and 2 together.
Having Windows code is one thing, cracking Google is another thing altogether.
Muchas Gracias, Señor Edward Snowden !
Why do obnoxious dumbasses like you bring up poverty everytime India does something good or aspires for something that only developed countries has 'rights' to? A developing country cannot aspire to have security and be able to defend itself from commie and islamic terror neighbours? Cant it become self-sufficient in space, defence and other technological advances? Because it is poor, the entire populace is doomed to live in 15th century?
I can't blame the Chinese government for wanting to have the encryption information ... and I can't blame India for not trusting Chinese technology. Nobody wins when no one trusts each other.
But there *are* winners !
In the case of India not importing Chinese equipments, the Japanese, European, Korean, and American companies suddenly become the de facto winners.
Muchas Gracias, Señor Edward Snowden !
"The Register reports that the Chinese government is forcing vendors to cough up the source code to their encryption alogrithms before they can sell their equipment to the Chinese government."
Something wrong with this sentence...
So India is worried about backdoors in products from China, but is not worried about backdoors being present in products from other countries?
They should be worried about any proprietary products from any country... China isn't the only country that might want to spy on India.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
All of this is a lot of work and will take a lot of time, who is going to pay for it ?
If they don't recompile it then the suspicion must be that they are more interested in getting/ripping-off the technology that doing a security audit.
a conspiracy theory.
Unless the source can be compiled from scratch and used in place of the pre-compiled versions, including flashing of firmware, creation of installable ROM images or OS installs, having source code guaranteed by analysis to be exploit-free gains the user nothing. There could still be spyware in the final product. Short of self-installing, I guess creation of bit-equivalent or checksum-equivalent binaries would be good enough as a verification mechanism. sesli sohbet