Slashdot Mirror
Should the US Really Limit Chinese-Government Influenced IT Systems?
coondoggie writes "New federal restrictions now preclude four U.S. agencies from buying information-technology (IT) systems from manufacturers 'owned, directed or subsidized by the People's Republic of China' due to national-security concerns. But is this a smart tactic? It's clear that some in the U.S. government, including the House Intelligence Committee — which issued a scathing report last fall that called Huawei and ZTE a threat to national security — and the Treasury Department's Committee on Foreign Investment in the U.S. are also working in other ways behind the scenes to keep technology made by China-based manufacturers out of U.S. commercial networks as well."
When you know who the foxes are, you keep closer watch over the henhouse. That just makes sense. It can be argued that there's still a role for inclusivity, but it has to be tempered with a dose of common sense.
"Duh".
I'm a little segfault, short and stout.
Is this even a real question? Of course they should. The Chinese government is openly attacking both corporate and government interests throughout the US. Why give them yet another avenue to attacks?
limit republican-leaning closed-source and un-auditable voting machines.
The Cloud - because you don't care if your apps and data are up in the air.
Any government contract should be fulfilled with domestically sourced and manufactured parts whenever possible. If we can make it here, we should. If you want to create/protect jobs, it starts by keeping the money in the country as much as possible.
The only thing necessary for evil to triumph is for it to be pitted against a slightly greater evil
Yes
Security aside, lets send our tax dollars to Chinese companies? Sure it saves the government a buck but saving money isn't the governments job. In fact one might argue its primary job is spending our tax dollars in ways that stimulate the development of domestic technology and jobs. The problem is, almost all the money goes to the Chinese anyway because most of the components are manufactured there. In the end both systems subsidize their domestic production, just here Uncle Sam demands something in return.
I would rather they insist that any such equipment bought by the US government be open and fully independently auditable. I think they would do a lot better for everybody if they simply made that a standard requirement of the procurement process.
Though, I can also well understand the paranoia. The US government has done the exact same thing to security equipment sold to other countries that they are now worried about China doing to us. They should be worried about that.
Need a Python, C++, Unix, Linux develop
China already protects itself from US-influence. This is protectionism, and we should all respond in kind.
Agreed, but I've been saying that ever since Billy Clinton, at the behest of his Wall St. masters, pushed so hard for premature PNTR and WTO membership for China. Sometimes I feel like I'm giving advice to 5th century Romans about how to keep out the barbarians - a little late.
^^ This post was paid for by the People republic of China
No government or private agency has come forward with conclusive proof that any product made in China for commercial resale has these capabilities built into it at the direction of the Government.
There's no conclusive proof that voting machines are rigged, ether. Should we guard against both, or one but not the other, or neither?
Depends on what you mean by conclusive, but there's a motive and there's a capability. For the capability part, see:
http://www.schneier.com/blog/archives/2012/05/backdoor_found.html
For every problem, there is at least one solution that is simple, neat, and wrong.
Besides violating over a dozen international treaties
Which would be so awful because China always honors its treaty obligations. Oh, except for not having a convertible currency, even years after they were obligated to by treaty, and manipulating their currency, and having illegal tariffs of as much as 35% on car parts (not to mention many other things), and ...
The first couple of times you don't retaliate you're taking the high road. After that you're just being a chump.
due to a long two hundred plus year history of using this labor-saving device known as chinese people to build our railroads, infrastructure, factories, etc., we don't have much in the way of domestic production capabilities for many of the major components of modern IT systems
Wow, talk about confused history. Those Chinese people building our railroads were called immigrants, hence that production was domestic. As incredibly hard working as those people were, I don't think they spent much time building IT equipment. However, many of their descendants did, but they're now getting screwed just like other American citizens.
And let me be clear: No government or private agency has come forward with conclusive proof that any product made in China for commercial resale has these capabilities built into it at the direction of the Government.
Good point. Never take precautions. Here in NY we've decided not to prepare for another hurricane because we have no proof that another one will occur.
I've seen some odd behavior with ZTE equipment that can't be explained away by bugs.
Wow, that is so vague, unattributed, based wildly on guesswork and almost impossible to prove that it just must be true!
you basically can't buy a computer without having at least some of its parts source, assembled, or otherwise passing through China
For really top secret stuff, you can, they should, and they do. It goes as far as getting the NSA its own chip fabrication facility at ft. meade. Do you want to work there?
Depends on what you mean by conclusive, but there's a motive and there's a capability.
The motive is specious at best. China's economy is growing at 7.8% annually, and while its slowing down, that's still beating the snot out of our 2.2% rate. And the purchasing power of both the US and China are comparable -- about $12 trillion USD. China's economy depends heavily on international trade, and the major buyer of Chinese goods is the United States, clocking in at 17.1% of it's total export capacity. Screwing up trading with its biggest partner would cause them an unacceptable level of economic crisis, and quite possibly destabilize global markets as well. China may not like the United States, but it's not about to shoot itself and the rest of the world in the head.
As for capability, as Schneier points out in his own article, the majority of IT systems, commercial, industrial, residential, all have backdoors in them. It shouldn't be a surprise that military IT equipment also has some. And as he later points out, this may have simply been put in to assist in debugging; As so many backdoors are often created with that specific purpose in mind.
All I'm saying here is that the arguments being made by the intelligence committee are specious. I'm not saying they're meritless, but that they fall well short of conclusive, and barely meet the standard for suspicious.
#fuckbeta #iamslashdot #dicemustdie
Besides violating over a dozen international treaties
[Citation needed]
I suspect the treaty situation isn't anywhere near as clear cut as that. Those agreements are riddled with exceptions.
Besides, every single one of those treaties, like our Constitution, is not a suicide pact. The President has said "national security" and every one of those documents is trumped. If We The People don't like it we can, through our Representatives, impeach, amend the constitution or march on Washington with pitchforks.
I predict none of those things is going to happen.
And let me be clear: No government or private agency has come forward with conclusive proof
Not relevant. We need not wait until we're exploited by Chinese hardware to justify our actions. We have at least two good reasons to anticipate hostile intent. First, we already know we're dealing with a government that is actively attacking our IT systems. Second, we've done the same to others.
The economic and political rammifications of this are being glossed over -- this action doesn't just affect our relationship with China, but with any country we do business with, because they signed the same treaties, and now they're looking at our unilateral action and thinking: What makes us think the US won't renege on their deal with us?
You have as your premise some deep respect for all these treaties and agreements. I believe most of these documents, particularly the trade agreements, are products of narrow interests creating special conditions for their exclusive benefit. I believe most of them amount to throwing open the ports and hobbling the port authorities to flood the US with stuff from places with no EPA, OSHA, NLRB, IRS, etc. I do not share your reverence for that crap.
As for the economic consequences; we've managed to survive and prosper without running our government on Huawei gear. I predict we can continue to afford to do without it.
Maw! Fire up the karma burner!
The Chinese were creating backdoored bootleg Cisco gear. I would surmise that violates a few international treaties and is justification for taking protective measures.
I am becoming gerund, destroyer of verbs.
The bios is manufactored, programmed, designed, and all made in China.
I would not be surprised if they have a backdoor to spy or be disabled. We know all our cell phones have this and can record everything with a secret code and the US government is in on that one. It has been posted on slashdot before as they are perfect spy devices for any citizen. It makes sense China would want the same.
Even the new Lenovo assembled PCs in the US are probably made in China. WIth firmware on all our weapons and planes China would love to disable our whole military in a blink of an eye if something like a conflict in Korea ever happened. The power is too incredible to ignore and CEOs to eager to comply to meet shareholder expectations and get their bonus.
http://saveie6.com/
You should probably review a little bit of your history before making the following statement, "at the behest of his Wall St. masters."
Where do you think Bobby Rubin came from (and returned to afterword)?
If you have a specific rebuttal I'd love to hear it, but vague "you should probably review a little bit of your history" remarks are barely worth it.
The real question is should our government buy counterfeit military replacement parts from China?
Until we as a people decide that our national security depends on our manufacturing base and manufacturing capability then what difference does it make? It's all coming from China no matter how you look at it. The subcontractor of my subcontractor of my subcontractor is Chairman Mao. And when you play in a commodity market, the lowest bidding supplier with a stolen formula for capacitors wins as in the case of Dell.
Any backdoors that are hidden and not disclosed to the customer should be treated as malicious.
... And China's inflation rate is climbing, with food costs up about 6% since last year. Much as it's nice to tout blistering GDP growth, it carries significant inflationary risk. The more important question: "Can or should governments aim for perpetual economic growth?"
Why suddenly has this come to forefront?
Because there has been classified evidence of compromises built into the hardware via the manufacturing process, which is in China or Taiwan. A shocking and deep threat.
They can't talk about it in public, but suddenly Sandia labs is upgrading its semiconductor manufacturing plant.
Because such information would not be classified, right? The US government would immediately run to the media to announce all the classified information that had been stolen by "special features" in Chinese hardware.
Surely the best thing to do would be to mandate the inclusion of the source code to the firmware with any government contract, and provide the ability to upload your own firmware image so you can ensure what you see in the code is what you are running.
Yes, I realise that this comes from a particular ideology that would be against the business interests of the hardware manufacturers. And while this wouldn't necessarily mean the firmware would be provided in an open source format to non-government users, it might make it more likely that they would do it.
Hardware back doors have already been identified in sensitive equipment as reported in slashdot before. http://it.slashdot.org/story/12/05/28/1454222/backdoor-found-in-china-made-us-military-chip So, yes this is a good idea.
Not a problem; we'll just settle our differences with Kim Jong-un and have the computers made in Kaesong, where labor is even cheaper.
How much proof do you need that a little attention to national security might be a good thing?
Python: 'And then suddenly you have a language which says "we're all stuck with whatever the whiniest coder wants".'
not only should we keep out the Chinese technology, we need to keep out the goddam Chinese!
China already protects itself from US-influence.
On the contrary, Huawei actively copied US code.
As with everything, this Chinese networking gear is nothing but a cheap copy originating from the world's bigges Xerox machine: China.
I'm not a complete idiot... Some parts are missing.
Don't be a tease. What was the shortest?
Besides violating over a dozen international treaties
The economic and political rammifications of this are being glossed over -- this action doesn't just affect our relationship with China, but with any country we do business with, because they signed the same treaties, and now they're looking at our unilateral action and thinking: What makes us think the US won't renege on their deal with us?
What? Which treaties require 4 particular U.S. agencies to purchase IT systems from the PRC?
How about "No" ?
I suspect the treaty situation isn't anywhere near as clear cut as that. Those agreements are riddled with exceptions.
Ask and ye shall receive. "In the event either Contracting Party applies quantitative restrictions to certain products originating in or exported to any third country or region, it shall afford to all like products originating in or exported to the other country treatment which is equitable to that afforded to such third country or region." Seems pretty clear cut to me.
Besides, every single one of those treaties, like our Constitution, is not a suicide pact. The President has said "national security" and every one of those documents is trumped. If We The People don't like it we can, through our Representatives, impeach, amend the constitution or march on Washington with pitchforks.
Yes, we can also commit mass suicide too. That doesn't mean we should. The President can say "national security" all he wants, but all I have to reply with is "Impeach" and that problem goes away pretty fast. What's your point in all of this? You're discussing theoreticals. My post was about actualities -- the actual facts are that China-US trade is critical to the stability of the global markets. 17% of China's exports are to the United States. We're their #1 destination. Why would they choose to fuck that up? And if we're going to shoot ourselves in the foot on this, wouldn't it behoove us to have somewhat more conclusive proof than a Fox News scareisode about how the Chinese want to destroy us all with their backdoors of mass destruction?
You have as your premise some deep respect for all these treaties and agreements. I believe most of these documents, particularly the trade agreements, are products of narrow interests creating special conditions for their exclusive benefit.
Okay, my turn: "Citation needed" Belief is not a rational basis from which to decide economic policy.
I believe most of them amount to throwing open the ports and hobbling the port authorities to flood the US with stuff from places with no EPA, OSHA, NLRB, IRS, etc. I do not share your reverence for that crap.
Again, prove it. They may not have an EPA, an OSHA, and NLRB, an IRS, or a bunch of other three and four letter acronym'd agencies, but none of that matters. Do the products meet specification, or don't they? If they do, let them in. If not, send them back. This is a very simple policy decision to make, and it requires no reverence, or belief.
#fuckbeta #iamslashdot #dicemustdie
Besides violating over a dozen international treaties...
Untrue. There are exceptions to WTO treaty obligations, one of which includes national security.
There were many claims from many different parties that the Chinese government engaged in active spying/covert intelligence gathering on New York Times, Google, RSA. And those are just the ones we know. Lets also not forget the Mandiant Report that caused such a reaction online not too long ago. None of this is conclusive proof but it sure is a great cause for concern.
The economic and political rammifications of this are being glossed over -- this action doesn't just affect our relationship with China, but with any country we do business with, because they signed the same treaties, and now they're looking at our unilateral action and thinking: What makes us think the US won't renege on their deal with us?
The consequences you paint may well be overblown. There is evidence that the US is not the only country worried about China's activities. Australia, for example, has blocked Huawei from bidding for work on its $38 billion national broadband network, for the same security fears. Germany has sent representatives to the Chinese Government to ask them to stop, unofficially. Even the UK is so worried about the China spying problem that Jonathan Evans, director general of MI5 publicly warned that the West now faces an "astonishing" cyber espionage threat on an "industrial scale" from specific nation states.
Given that China itself uses national security as a reason for imposing restrictions on foreign commercial activities on its shores, I really don't think there is any basis to complain about the present measures introduced by the US.
Not much choice, and after seeing a few games Cisco plays (dragging somebody out of a courtroom in session - how's that for contempt of the law?) they are probably far more trustworthy than Cisco, and Cisco get their stuff built in China anyway.
As distinct for paying far more for legit backdoored Cisco gear. Cisco are corrupt scum these days - they'd sell their own grandmother if they hadn't already done it five years ago.
What better way to break all the secrets out, than to use Chinese-made computers? Short of uploading the stuff directly to them, I can't see a better way to free the oppressed information from the confines of secrecy.
In Soviet Washington the swamp drains you.
That sounds just like US steel and sugar cane, and it's bound to backfire on them in the long run exactly the same way. You can't build a competitive industry that way only a lazy one.
Still, it's quite funny seeing someone from the USA complain about another nations tariffs in such terms. It shows a bit of a gap in school education over there since people appear to be unaware of their countries trade policy.
Huawei stealing secrets? No Way!
Well it wasn't "Woosh".
This should not be just for the really secret stuff. The Chinese are using cyber attacks for industrial espionage.
The comments like the original poster and the one you quoted are from the Walmart shoppers looking for that penny deal.
Nothing relating to international law is clear cut. In this case, you forgot Article XXI of GATT, "Security Exceptions."
"Nothing in this Agreement shall be construed
(a) to require any contracting party to furnish any information the disclosure of which it considers contrary to its essential security interests; or
(b) to prevent any contracting party from taking any action which it considers necessary for the protection of its essential security interests
(i) relating to fissionable materials or the materials from which they are derived;
(ii) relating to the traffic in arms, ammunition and implements of war and to such traffic in other goods and materials as is carried on directly or indirectly for the purpose of supplying a military establishment;
(iii) taken in time of war or other emergency in international relations; or
(c) to prevent any contracting party from taking any action in pursuance of its obligations under the United Nations Charter for the maintenance of international peace and security."
The great thing about this article is it's self-judging -- in particular, XXI(b)(ii) can be interpreted to apply to almost anything. Cf. http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2079608.
Any backdoors that are hidden and not disclosed to the customer should be treated as malicious.
Backdoors are common (over 50% of devices have documented ones... undocumented is probably much higher). Backdoors aren't disclosed up front, it's most always after the fact. By your logic, we should all throw away every electronic device we own and hide under the bed. Sorry... I don't subscribe to security puritanicalism -- I'm a realist. Backdoors are present in most of the devices I own, but I can still consider them secure enough for my uses because the odds of someone being able to find a backdoor in every device in the chain and end up with an exploitable condition is still low if everything is configured correctly.
There is no such thing as perfect security. Nothing is unhackable. So I'd rather live in a world where we test for backdoors in critical systems, document what we do find, and have the infrastructure and knowledge to react quickly to any problems that are found... because frankly, information systems are far, far too complex for your ideology to have any hope of implimentation.
#fuckbeta #iamslashdot #dicemustdie
...is that the Federal Government allowed Microsoft to hand over source code for the NT kernel not so long ago...
http://www.informationweek.com/software/operating-systems/china-gets-a-peek-at-microsoft-source-co/225400063
...and look what happened!
http://www.businessinsider.com/wikileaks-china--microsoft-source-hack-google-2010-12
Oh dear.
Operation Guillotine is in effect.
Bill Clinton had lots of rumors floating about him being a ChiComm stooge, partially because several major supporters were shown to have laundered ChiComm contributions to his campaigns (he DID return the contributions after this was shown, even if always after the elections that the money helped him win).
.sarc on
Anyone want to bring up the Clinton Death Lists, now?
.sarc off
Get to the battle field first, knock out the communications, and obliterate the enemy.
Obviously AC has never read Sun Tzu. He was not a Chinese Nathan Bedford Forrest. A battle avoided, because the enemy had to retire rather than risk it, was always his best solution.
I don't think you replied to what I wrote.
I said they should be treated as malicious if they're not disclosed to the customer. The customer is the person or company who has told you to build something for them.
When I said customer, I did not mean Joe Bloggs buying a widget at Walmart.
If I build you some software and put in my own secret back door to gain remote access to the system without your knowledge, would you simply assume my intent was benign?
What if I built all the systems you own? How it is not going to be trivial for me to go through all the back doors I built?
Just because the US has done this stuff doesn't mean we have any obligation to take the risk that it would be done to us. Or do you also believe that a rapist should be raped in order to punish them for their crime?
Funny how people lose any ability to think when the conclusion is that they're wrong, or even just contradicting themselves.
It's still prudent to close the barn door to keep the rest of the livestock in, and the varmints out.
Chinese components and software are obvious attack vectors. Only a fool would believe they would not be set in place beforehand, or used during any significant conflict.
Please do not read this sig. Thank you.
No
It is should the WEST limit it? The answer is yes.
It is insane to allow a nation that is undergoing the world's largest military build-up ever seen in history, and who is forcing all of the prices to be artificially low, along with massive tariffs, to put their compromised systems into the West.
Heck, even China is bright enough to say no to Western goods into their systems.
I prefer the "u" in honour as it seems to be missing these days.
If you are ANY nation out there, China will spy on you. If you are aligned with China, the west is going to spy on you. If you are a western nation, we tend to not spy on each other (that is not quite accurate either, but close enough).
I prefer the "u" in honour as it seems to be missing these days.
false. It will NOT abolish it. It will not be used against nations from the EU, but, it allows us to keep using it.
I prefer the "u" in honour as it seems to be missing these days.
http://www.amazon.com/Betrayal-Administration-Undermined-American-Security/dp/0895261960/ref=sr_1_2?s=books&ie=UTF8&qid=1365094897&sr=1-2&keywords=betrayal+clinton
I object to power without constructive purpose. --Spock
I am concerned china can use st software to spy on us , so yes that is a reason to limit Chinese software use.