Slashdot Mirror
Should the US Really Limit Chinese-Government Influenced IT Systems?
coondoggie writes "New federal restrictions now preclude four U.S. agencies from buying information-technology (IT) systems from manufacturers 'owned, directed or subsidized by the People's Republic of China' due to national-security concerns. But is this a smart tactic? It's clear that some in the U.S. government, including the House Intelligence Committee — which issued a scathing report last fall that called Huawei and ZTE a threat to national security — and the Treasury Department's Committee on Foreign Investment in the U.S. are also working in other ways behind the scenes to keep technology made by China-based manufacturers out of U.S. commercial networks as well."
When you know who the foxes are, you keep closer watch over the henhouse. That just makes sense. It can be argued that there's still a role for inclusivity, but it has to be tempered with a dose of common sense.
Is this even a real question? Of course they should. The Chinese government is openly attacking both corporate and government interests throughout the US. Why give them yet another avenue to attacks?
limit republican-leaning closed-source and un-auditable voting machines.
The Cloud - because you don't care if your apps and data are up in the air.
Any government contract should be fulfilled with domestically sourced and manufactured parts whenever possible. If we can make it here, we should. If you want to create/protect jobs, it starts by keeping the money in the country as much as possible.
The only thing necessary for evil to triumph is for it to be pitted against a slightly greater evil
Yes
I would rather they insist that any such equipment bought by the US government be open and fully independently auditable. I think they would do a lot better for everybody if they simply made that a standard requirement of the procurement process.
Though, I can also well understand the paranoia. The US government has done the exact same thing to security equipment sold to other countries that they are now worried about China doing to us. They should be worried about that.
Need a Python, C++, Unix, Linux develop
Depends on what you mean by conclusive, but there's a motive and there's a capability. For the capability part, see:
http://www.schneier.com/blog/archives/2012/05/backdoor_found.html
For every problem, there is at least one solution that is simple, neat, and wrong.
Besides violating over a dozen international treaties
Which would be so awful because China always honors its treaty obligations. Oh, except for not having a convertible currency, even years after they were obligated to by treaty, and manipulating their currency, and having illegal tariffs of as much as 35% on car parts (not to mention many other things), and ...
The first couple of times you don't retaliate you're taking the high road. After that you're just being a chump.
due to a long two hundred plus year history of using this labor-saving device known as chinese people to build our railroads, infrastructure, factories, etc., we don't have much in the way of domestic production capabilities for many of the major components of modern IT systems
Wow, talk about confused history. Those Chinese people building our railroads were called immigrants, hence that production was domestic. As incredibly hard working as those people were, I don't think they spent much time building IT equipment. However, many of their descendants did, but they're now getting screwed just like other American citizens.
And let me be clear: No government or private agency has come forward with conclusive proof that any product made in China for commercial resale has these capabilities built into it at the direction of the Government.
Good point. Never take precautions. Here in NY we've decided not to prepare for another hurricane because we have no proof that another one will occur.
you basically can't buy a computer without having at least some of its parts source, assembled, or otherwise passing through China
For really top secret stuff, you can, they should, and they do. It goes as far as getting the NSA its own chip fabrication facility at ft. meade. Do you want to work there?
Depends on what you mean by conclusive, but there's a motive and there's a capability.
The motive is specious at best. China's economy is growing at 7.8% annually, and while its slowing down, that's still beating the snot out of our 2.2% rate. And the purchasing power of both the US and China are comparable -- about $12 trillion USD. China's economy depends heavily on international trade, and the major buyer of Chinese goods is the United States, clocking in at 17.1% of it's total export capacity. Screwing up trading with its biggest partner would cause them an unacceptable level of economic crisis, and quite possibly destabilize global markets as well. China may not like the United States, but it's not about to shoot itself and the rest of the world in the head.
As for capability, as Schneier points out in his own article, the majority of IT systems, commercial, industrial, residential, all have backdoors in them. It shouldn't be a surprise that military IT equipment also has some. And as he later points out, this may have simply been put in to assist in debugging; As so many backdoors are often created with that specific purpose in mind.
All I'm saying here is that the arguments being made by the intelligence committee are specious. I'm not saying they're meritless, but that they fall well short of conclusive, and barely meet the standard for suspicious.
#fuckbeta #iamslashdot #dicemustdie
Besides violating over a dozen international treaties
[Citation needed]
I suspect the treaty situation isn't anywhere near as clear cut as that. Those agreements are riddled with exceptions.
Besides, every single one of those treaties, like our Constitution, is not a suicide pact. The President has said "national security" and every one of those documents is trumped. If We The People don't like it we can, through our Representatives, impeach, amend the constitution or march on Washington with pitchforks.
I predict none of those things is going to happen.
And let me be clear: No government or private agency has come forward with conclusive proof
Not relevant. We need not wait until we're exploited by Chinese hardware to justify our actions. We have at least two good reasons to anticipate hostile intent. First, we already know we're dealing with a government that is actively attacking our IT systems. Second, we've done the same to others.
The economic and political rammifications of this are being glossed over -- this action doesn't just affect our relationship with China, but with any country we do business with, because they signed the same treaties, and now they're looking at our unilateral action and thinking: What makes us think the US won't renege on their deal with us?
You have as your premise some deep respect for all these treaties and agreements. I believe most of these documents, particularly the trade agreements, are products of narrow interests creating special conditions for their exclusive benefit. I believe most of them amount to throwing open the ports and hobbling the port authorities to flood the US with stuff from places with no EPA, OSHA, NLRB, IRS, etc. I do not share your reverence for that crap.
As for the economic consequences; we've managed to survive and prosper without running our government on Huawei gear. I predict we can continue to afford to do without it.
Maw! Fire up the karma burner!
Any backdoors that are hidden and not disclosed to the customer should be treated as malicious.
Why suddenly has this come to forefront?
Because there has been classified evidence of compromises built into the hardware via the manufacturing process, which is in China or Taiwan. A shocking and deep threat.
They can't talk about it in public, but suddenly Sandia labs is upgrading its semiconductor manufacturing plant.
Surely the best thing to do would be to mandate the inclusion of the source code to the firmware with any government contract, and provide the ability to upload your own firmware image so you can ensure what you see in the code is what you are running.
Yes, I realise that this comes from a particular ideology that would be against the business interests of the hardware manufacturers. And while this wouldn't necessarily mean the firmware would be provided in an open source format to non-government users, it might make it more likely that they would do it.
How much proof do you need that a little attention to national security might be a good thing?
Python: 'And then suddenly you have a language which says "we're all stuck with whatever the whiniest coder wants".'
Get to the battle field first, knock out the communications, and obliterate the enemy.
Obviously AC has never read Sun Tzu. He was not a Chinese Nathan Bedford Forrest. A battle avoided, because the enemy had to retire rather than risk it, was always his best solution.
Just because the US has done this stuff doesn't mean we have any obligation to take the risk that it would be done to us. Or do you also believe that a rapist should be raped in order to punish them for their crime?
Funny how people lose any ability to think when the conclusion is that they're wrong, or even just contradicting themselves.