Real Questions about Huawei for US Rep. Frank Wolf

Chris Parker Interesting article, thank you. A quick scan of the world wide wobbly reveals many interesting and fact based stories about the US Government and companies. I am not looking to defend anyone, but it does look like Huawei are suffering from American protectionism. No offence to the congressman but I think he needs to get out more.

“Leaked e-mails provide a tantalizing glimpse of life behind the security curtain. HBGary and HBGary Federal were small players in this space; indeed, HBGary appears to have made much of its cash with more traditional projects, like selling anti-malware defence tools to corporations and scanning their networks for signs of infection. If rootkits, paranoia monitors, cartoons, and fake Facebook personas were being proposed and developed here, one can only imagine the sorts of classified projects underway throughout the entire defence and security industry. But the e-mails also remind us how much of this work is carried out privately and beyond the control of government agencies. We found no evidence that HBGary sold malware to nongovernment entities intent on hacking, though the company did have plans to repurpose its DARPA rootkit idea for corporate surveillance work. ("HBGary plans to transition technology into commercial products," it told DARPA.)”

Military Networks ‘Not Defensible,’ Says General Who Defends Them. “Gen. Keith Alexander, head of both the secretive National Security Agency and the military’s new U.S. Cyber Command, has tens of thousands of hackers, cryptologists, and system administrators serving under him. But at the moment, their ability to protect the Defence Department’s information infrastructure — let alone the broader civilian internet — is limited. The Pentagon’s patchwork quilt of 15,000 different networks is too haphazard to safeguard”

Meet The Hackers Who Sell Spies The Tools To Crack Your PC (And Get Paid Six-Figure Fees). “We wouldn’t share this with Google for even $1 million,” says Bekrar. “We don’t want to give them any knowledge that can help them in fixing this exploit or other similar exploits. We want to keep this for our customers.” Those customers, after all, don’t aim to fix Google’s security bugs or those of any other commercial software vendor. They’re government agencies who ­purchase such “zero-day” exploits, or hacking techniques that use undisclosed flaws in software, with the ­explicit ­intention of invading or disrupting the computers and phones of crime suspects and intelligence targets

“No end-user or organisation would contemplate leaving the front door to their home or office unlocked as their private property and confidential information could be exposed to theft. However, many are still leaving themselves at risk from another angle. By not addressing vulnerabilities (errors in software installed on end-points that can be exploited), these very same end-users and organisations are effectively leaving their ‘windows’ wide open as entry points for cybercriminals to compromise sensitive financial/employee/personal data. Indeed, everyone who uses the Internet – 31% of the Earth’s population – is a potential victim of cybercrime.”

“Exclusive: Google, Amazon, and Microsoft Swarm China for Network Gear”. “Google, Amazon, Microsoft, and Facebook buy more networking hardware than practically anyone else on earth. After all, these are the giants of the internet. But at the same time, they’re buying less and less gear from Cisco, HP, Juniper, and the rest of the world’s largest networking vendors.”. “Over the past few years, the giants of the web have changed the way they purchase tens of thousands of the network switches inside the massive data centers driving their online services, quietly moving away from U.S.-based sellers to buy cheaper gear in bulk straight from China and Taiwan”
http://www.wired.com/dangerroom/2012/01/nsa-cant-defend/
http://www.forbes.com/sites/andygreenberg/2012/03/21/meet-the-hackers-who-sell-spies-the-tools-to-crack-your-pc-and-get-paid-six-figure-fees/
http://secunia.com/resources/reports/
http://www.wired.com/wiredenterprise/2012/03/google-microsoft-network-gear/

I would add a few questions of my own:

• It appears that the design and development of hacking exploits is a commercial activity understood and accepted by Governments and Government agencies around the world. Should Governments really be surprised that they themselves are hacked when they are stimulating a market to build such capability.
• Has the Australian Government just bowed to pressure from the USA? 3 days after Huawei told the USA announces moving troops into northern Australia… forgive me coincidence?
• It is clear that some of the world’s largest cloud providers to the USA are directly buying servers and network equipment from China. In what way is this channel protected and in what way does it differ from buying equipment and services from Huawei.
• From the Forbes article it is alleged that Northrop Grumman builds zero day exploits for Government, yet they are also a major supplier to the American Government. Is this behaviour acceptable and are these exploits used to penetrate other Government establishments?
• In what way is that the safety and security of Ericsson products different to Chinese based vendors? Is BYT is Huawei China based when two thirds of their work is outside of China, just a though?
• Given that Huawei claim to be privately owned by its employees who have a substantial stake in its success as their personal investment and pensions are locked into the success of the company, what is the greatest security risk, an employee owned company or a Chinese Government backed company such as Alcatel-Lucent or Cisco
• As we can see all international technology companies, including Microsoft, have research and development centres in China. Surely if there is a perceived risk from Chinese products the risk must be the same if not greater for other companies. I suggest greater because everyone examines Chinese products and services and does little validation on other vendors
• There is much press speculation that CISCO and HP have been assisting Governments to install monitoring capability. What does the honourable congressman think about that
• US Government has a cloud first policy, the DoD et el are going to cloud yet as the article explains the big cloud vendors are buying technology directly from China… oops

The reality is the technology is joined up, the global supply chain is just that, global. When the world is round just pointing the finger comes straight back to you. Congressman, Senators be part of the global solution not part of the global problem.