When matters-of-State trump matters-of-commerce...Everyone loses

Heralding a new chapter of matters-of-state upending matters-of-commerce, a November 2, 2013 Australian Financial Review (AFR) article sports a telling title: “Global Digital Wars Take Australia Hostage” (link).  In what seems, on balance, a well-researched article (with a couple of glaring exceptions), the AFR piece details how, among other things, American government pressure on Australian authorities may have contributed to an initial ban on Huawei’s participation in Australia’s National Broadband Network (NBN) three years ago, as well as that ban’s very recent renewal under the newly-elected regime Down Under.

The authors ably detail the ongoing saga of Australia’s Government-sponsored NBN project,  first announced in 2008.  They report that “while the Australian public first learned that Huawei had been sensationally barred from any involvement in the NBN in March 2012, the intelligence community appears to have made its mind up by 2008 at a time when Chinese espionage concerns were climaxing.”  They add: “Around this time a highly classified team of three representatives from the Attorney-General’s Department, ASD and ASIO were sent on a global fact finding mission, which included a lunch in the CIA director’s ­personal ante room, to consult with ­Australia’s international intelligence partners on Chinese telco risks. Huawei was the key target.  While the triumvirate could find no smoking gun, the report, which is believed to have been submitted to cabinet’s national security committee, was said to be very clear in its conclusion. In the words of one participant, “the risk of allowing Huawei to help build the NBN was just too serious to contemplate.”

According to the article, shortly thereafter, in April 2009, the initial NBN tender was cancelled, only to be re-opened not long later, with the possibility of Huawei participation.  Another government review was conducted and, again, Australian intelligence services balked against Huawei involvement in the NBN.  The article continues, reporting that while Huawei was “blindsided” when it was announced in June 2010 that Alcatel-Lucent had been selected as the initial NBN equipment supplier, the company continued to believe, based on indications from senior Australian Administration officials in 2011, that they would be chosen as “one of the NBN Co’s two primary vendors in a multi-company model that maximised competitive pricing tension and product innovation.”  Once again, my countrymen stepped in: Per the article, “In November 2011 President Barack Obama paid his first official visit to ­Australia. One conspiratorial month later the Attorney-General’s Department asked Huawei’s brass to come to Canberra…” where “­officials informed them they were being barred outright from involvement in the NBN, a message that was formalised in a letter months later.”

Finally, in terms of detailing the NBN tale to date, the AFR article neatly captures last week’s unfortunately updated news, reporting “In a single week the world’s largest telecommunications equipment provider, Huawei, has swung from the prospect of being triumphantly welcomed back into Australia’s national broadband network to having Prime Minister Tony Abbott humiliatingly reaffirm Labor’s ban on China’s national champion.”  Again, Huawei had anticipated a policy course-correction in the context of a shift in Australian Government leadership.  And, yes, again, the U.S. had been ratcheting up the screws on Australian authorities: “In an exclusive report in the AFR in July 2013, the only man to have ever led both the CIA and NSA, General Michael Hayden, alleged Huawei had ‘shared with the Chinese state intimate and extensive knowledge of the foreign telecommunications systems it is involved with’ and intelligence agencies have evidence to prove it.”

Hayden’s empty rhetoric aside, in addition to relaying the history of the NBN saga, the AFR article points out that the concerns about Huawei were, as much as anything else, defined by intelligence types “looking in a mirror:”  “It is no small irony that the scores of intelligence operatives interviewed by the Financial Review over the past nine months repeatedly noted that early assessments of the Huawei risks were based on what agencies knew of the capabilities employed by western intelligence. “Put it this way,” one spook says, “If Huawei was run by Americans or Australians, we’d be doing what we say they are doing.”  Later in the piece:  “We are base-lining their capabilities and operations off what we know we can do – not on what they are actually doing…”  And again:  “Yet as another Australian intelligence executive notes, ‘The only reason we can make assessments like that is because we know we are up to with our own firms’”. 

As for the glaring exceptions I referenced in the opening paragraph to this post, for whatever reason the authors seem to discard careful research in favor of shallow reporting in the article’s “The Evidence” paragraph, which begins with a reiteration of a very tired and obviously incorrect version of Huawei’s Founder and CEO bio.  Per the AFR piece: “Ren Zhengfei, was a deputy director in the ­People’s Liberation Army’s Information Engineering Academy, which is associated with China’s electronic intelligence efforts.”  Flash back to my March 23, 2013 blog post titled “Obscure 2000 Report – Source of much Huawei Mis-information – Corrected, Finally…” (link) in which I detailed how the U.S. Center for Strategic and International Studies (CSIS) – no friend to Huawei – put the false version of the bio to rest by exposing it as a misinformed media report from the year 2000 that had been subsequently mis-referenced by government and media for the better part of a decade.  Notably, the opening sentence of “The Evidence” paragraph similarly features an equally incorrect version of Huawei’s Chairwoman’s bio.

The paragraph continues with additional mis-statements, again reflecting a rather bizarre deviation from studious reporting on the part of the authors.  For instance, there is this statement: “Australian security authorities cite British intelligence highlighting that Huawei has been able to undercut foreign competitors, and obtain speculator market share growth, by enticing customers with up to $30 billion of ultra-cheap loans, or “vendor finance”, funded by Chinese state-controlled banks.”  This bit of misinformation has been soundly debunked for almost two years.  Indeed, in a June 13, 2011 blog post titled “Calling Foul on Exim’s Huawei FUD” (link) I carefully exposed the fallacy behind the “$30 billion in financing” claims.  Huawei has further clarified (and updated) these facts on numerous occasions for numerous audiences – it is a bit befuddling that the AFR authors didn’t do the homework here that they obviously did in preparing the balance of their article.

“The Evidence” paragraph concludes with reference to “A senior official working inside ASD” who in 2009 claims “that by leveraging off an NSA executive embedded in ASD they were able to obtain a top secret ‘noforn’ (no ­foreign eyes) technical NSA report that ­identified irrefutably malicious “program code” that had been deliberately inserted into the “firmware” in Huawei devices. This backdoor could be installed or replaced with a benign substitute by Huawei executives remotely managing the network in question.”  This is certainly intriguing (particularly in the context of the Australians leveraging "embedded" NSA executives to disclose U.S. "noforn" information to foreigners, allies or not), but hardly a verifiable source for reporting purposes, which, again, is puzzling given the more studious, fact-based approach taken in the balance of the article. 

Indeed, further to that latter point, and in the context of "truthfulness" and the "reliability"of sources, we should perhaps remember that the NSA is the organization whose leader promotes "collecting the haystack to find the needle" (link) and yet, paradoxically, per multiple U.S. Government spokespeople, the NSA is in fact not hoovering up and analyzing our calls and mails, notwithstanding rather dramatic evidence to the contrary.

In any event, the article lays bare the fact that what is really happening Down Under is, in the authors’ words, “just a localised skirmish in a far wider and more complex conflict between the world’s two most powerful nations, China and the United States.”  It’s certainly not about network security and data integrity.  All parties are more than aware of the fact that every telecom gear vendor is subject to common, industry-wide vulnerabilities and threats.  Blocking one vendor by virtue of its country of headquarters does nothing to secure networks and data, given that all vendors rely on common and global supply chains, which utterly exposes the hypocrisy of such blockades (and, incidentally, in terms of hypocrisy, why isn’t anyone pointing out that a primary winner of the Australia NBN deal - France-based Alcatel-Lucent - is the 50% owner of China-based Shanghai Bell, from which much of the NBN gear will almost certainly ship, and the balance of Shanghai Bell is owned by the Chinese Government?).

Why do we all lose?

Network security and data integrity are very real concerns, but politico-protectionist blockade-like remedies not only don't address these concerns, they introduce new ones: Stymied investment and innovation, fewer jobs, less competition, more expensive broadband and nasty market-access barriers that, if and when replicated, will very likely fragment the global information and communications technology industry and Balkanize the Internet.  From there, the cycle renews and feed upon itself, leading, almost certainly and ultimately, to strife and conflict.  Is this in anyone's best interest? 

Recapping: From Snowden to Hayden

For regular readers, you are well aware that this blog has evolved since it was created in 2005 - from the wistful or proud musings of a father too-often on the road, to the hopeful hype of a mobile tech geek, to the more recent focus on cyber-hysteria, and the related American-inspired travails experienced by my employer Huawei Technologies.

With respect to the latter area of focus, things have reached a fever pitch.

Three-plus years ago, when I joined Huawei, the blackballing of the company by the U.S. Government was relatively easy – black and white – China bad, everything else okay.  There was no need for rules, regulations or transparency – indeed, the protectionist machinations in use at the time were generally ham-handed, what one might have expected from a tin-pot regime, not the leader of the free world.

But over the last year, we have seen a shift towards more rational dialogue, towards more potentially fair and open policy - until recently, at least.

The conclusion of last years’ House Permanent Select Committee on Intelligence (HPSCI) “investigation” (hardly) of Huawei was a report which is broadly viewed as redefining the word vapid.  The Economist  perhaps captured it best: The report appeared “to have been written for vegetarians…not much meat in it.”

That was a turning point.  The politics were exposed for what they were. 

Indeed, When HPSCI Chairman Rogers and Ranking Member Ruppersberger jabbed fingers at Huawei executives demanding “If you want to do business in our country then you tell your government to stop hacking our networks,” it was rather clear that their agenda was geopolitical, not truly driven by any legitimate concern about Huawei.  After all, when it came to Huawei, after a years’ “investigation,” they revealed that they had turned up exactly squat.

Meanwhile, in the world of facts and rational thought, debate had turned to real challenges: Given that the information and communications technology (ICT) industry had evolved into a state of transnationalism, so too had cyber threats become borderless, and there was growing recognition that only real and global solutions would be effective at addressing such challenges (see related blog post from April 2012 or, for a deeper review, my blog post from July 2011).

The tide was indeed turning.

In February 2013, President Obama issued an Executive Order focused on Improving Critical Infrastructure Cybersecurity.  A key element of his Order was the establishment of a Cybersecurity Framework which would be “technology neutral and that enables critical infrastructure sectors to benefit from a competitive market for products and services that meet the standards, methodologies, procedures, and processes developed to address cyber risks.” 

Good stuff.  Right direction.

Another major inflection point was the late March passing of the Continuing Resolution that would fund the U.S. Government through the end of the fiscal year in September.  Late in the process, with a Government shut-down imminent, a brief paragraph (Section 516) was slipped into the hundreds-of-pages long document which would ban some federal purchases of networked equipment “produced, manufactured or assembled” by any group with a strong connection to China (“owned, directed or subsidized”). 

Eeeek.

Eleven major U.S. industry associations – ranging from the Chamber of Commerce to the Information Technology Industry Council – wrote an April 4 letter to Congressional leadership expressing dire concern that a ban on federal purchases from China could make the US government vulnerable by restricting access to the latest security technology and could invite reciprocity in terms of the Chinese government screening technology from the U.S. in the same way. 

Per the U.S. industry associations’ letter: “Geographic-based restrictions run the risk of creating a false sense of security when it comes to advancing our national cybersecurity interests. At a time when greater global cooperation and collaboration is essential to improve cybersecurity, geographic-based restrictions in any form risk undermining the advancement of global best practices and standards on cybersecurity.”

Remarkable words of reason.

While the President had already signed the bill into law (at least until the end of the fiscal year when a new budget bill will be considered), a White House spokesperson was quoted in The Hill the day after the industry letter was written: “The undefined terms of this provision will make implementation challenging,” adding “It could prove highly disruptive without significantly enhancing the affected agencies’ cybersecurity.”

More good stuff.

Shortly thereafter, the Government Accountability Office (GAO) – the investigative arm of the US Congress – issued an unrelated study titled “Communications Networks: Outcome-Based Measures Would Assist DHS in Assessing Effectiveness of Cybersecurity Efforts” which found that “No cyber-related incidents affecting core and access networks have been recently reported to FCC and DHS through established mechanisms…of the over 35,000 outages reported to FCC during this time period , none were related to traditional cyber threats (e.g., botnets, spyware, viruses, and worms).”  See my overly-snarky blog post on this particular development, a reflection of facts yet further trumping fiction.

Mere days later, U.S. Secretary of State Kerry met with Chinese counterparts where both sides committed to cooperating on cyber-security issues, a reflection of yet more rational thought breaking out, and a concept about which I had pondered in a March 2012 post.

That same week, the world-renowned and respected Brookings Institution issued a remarkably thoughtful and balanced White Paper titled “Twelve Ways to Build Trust in the ICT Global Supply Chain.”  

The Brookings paper acknowledged the realities of today’s globalized ICT industry: “As trade grows more globalized, the supply chain has become more complex and challenging. Contemporary commerce involves hundreds of individuals, organizations, technologies, and processes across continents,” and went on to propose rational, non-political solutions towards addressing the related challenges, suggesting that “developing agreed-upon standards, using independent evaluators, setting up systems for certification and accreditation, and having trusted delivery systems will build confidence in the global supply chain as well as the public and private sector networks that sustain them.”

Yes, indeed, the tide was turning…

And then along came Snowden. 

We’ve all read the same stories, but, for anyone interested in some perhaps novel flavor, see my flurry of posts following his initial revelations, in which I have been perhaps more concerned about the potential fragmentation of the Internet than any impact on my employer: “Through the Looking Glass” (June 6), “PRISM and Internet Balkanization” (June 7), “PRISMs and Mirrors and Cyber (Oh my)” (June 9), “Politics, Intelligence and Lies – Get a Clue(train)” (June 11), “Internet Balkanization Yet More Likely – PRISM+” (June 14), “A Thickening Plot – A Devil’s Bargain?” (June 19). 

Since Snowden, having utterly lost the cyber high ground, various and sundry U.S. Government authorities have scrambled – stumbling, fudging, lying – to rebuild trust, both at home and abroad, as often as not, with attempts to divert attention elsewhere.

A seemingly key element of the strategy has been to ratchet up the China cyber-threat (which is very real, mind you, as are the cyber threats from virtually every other country on the planet), and, specifically, to differentiate U.S. espionage from Chinese espionage on the grounds that the U.S. focuses on national security intelligence while China steals commercial secrets.

The differentiation strategy kinda fell apart on July 9 when the media began broadcasting Snowden’s latest revelation: The NSA had in fact been conducting commercial espionage across key Latin American markets focused on the oil and energy sectors.

It would appear, however, that some in the U.S. had a slight heads-up on this particular leak, and tried to get out in front of it with some distracting chaff.

One day earlier, on July 8, HPSCI Chairman Rogers re-emerged from his Huawei-bashing hibernation, appearing on BBC 4 Radio, and, for the first time ever, suggesting that he had “proof” of Huawei ties to the PRC and instances of corporate espionage.  Yet again, however, he provided not a whit of substance (link to detailed blog post). 

That same day, PBS Newshour ran a program titled “U.S. Government, Industry Fed Up With China Cyber Theft” featuring another noted China-hawk, James Mulvenon.  Mulvenon was one of the principle authors of the 2005 RAND Report which was only recently revealed to have clumsily featured patently false information about Huawei.

Mulvenon, notwithstanding a remarkably impressive pedigree, took the lateral from Roger’s BBC script and graduated from a past record of innuendo to out-and-out lying, stating, in reference to Huawei: “There's a well-documented record of them stealing core technology from Cisco and from Nortel…I think that Huawei has directly benefited from being able to take core R&D from other people.”  What Mulvenon may “think” doesn’t make it fact, and his reference to “well-documented records” is nothing but a flat-out lie.

Thus, with the media appropriately fluffed, it was time to trot out yet bigger guns.  Next up to twirl a bright and shiny object to distract attention from the increasingly damning revelations about U.S. espionage activities, including in the commercial realm, was none other than former NSA and CIA Director Mike Hayden, one of the midwives of PRISM.

In a July 19 interview with the Australian Financial Review which covered a wide range of cyber issues, General Hayden took Mulvenon’s handoff and ran for what he must have hoped would be a touchdown. 

Asked whether Huawei represents “an unambiguous national security threat to the US and Australia, the General replied “Yes, I believe it does.”  Asked if there was hard evidence of Huawei having engaged in espionage on behalf of the Chinese state, Hayden evaded the tackle with a linguistic summersault, stating “Yes, I have no reason to question the belief that’s the case,” and then, of course, added “as the former director of the NSA, I cannot comment on specific instances of espionage or any operational matters.”  He then went on to cite last years’ utterly empty HPSCI report as some sort of substantive proof point.

Talk about circular bullshit… 

(And, never one to be left out, CSIS’s resident cyber flak – a Huawei-bashing cheerleader who never fails to put out for the team – chimed in meaninglessly in a UPI report: "Officials within several agencies have privately told me that Huawei is a national security threat."  Why does anyone listen to this guy?).

So, what next?

From an industry-wide perspective, in the wake of HPSCI having blown its insignificant load last Fall, and until the Snowden hullabaloo, there had been quite positive momentum towards the establishment of commercially rational and effective worldwide standards and disciplines to better secure networks and information. 

The U.S. Government, caught with its cyber slip showing, is to some extent derailing the process with mis-directing rhetoric. 

Deal with it guys.  Enough with the bright and shiny distractions.  Enough with the Huawei bashing.  You got issues with China, then manage them.   But enough maligning of innocent companies that are otherwise world-proven and trusted. 

You got something on Huawei – show it.  You don’t – and if you did, you’d have ponied up by now – then stow it.