Challenging Cheney's "Exceptionalism" Op-ed

An August 28, 2015 Wall Street Journal commentary by former Vice President Cheney popped up in my Facebook feed today, titled “Restoring American Exceptionalism.” 

Citing select truths, while plucking patriotic heartstrings, the Vice President argues forcefully against the recent multilateral (U.S., UK, Germany, France, Russia, China) accord with Iran that will end decades of economic sanctions against that country in exchange for restrictions on its nuclear program. 

Cheney criticizes and labels President Obama as a latter-day Neville Chamberlain, utterly ignoring that the unstable environment in which the President is compelled to operate is the direct result of the duplicitous and failed policies in large part architected by himself.

But first, in fairness, let’s acknowledge the select truths from the Cheney op-ed:

·         “America has guaranteed freedom, security and peace for a larger share of humanity than any other nation in all of history.”

·         “In the 1940s American leadership was essential to victory in World War II, and the liberation of millions from the grip of fascism. In the Cold War American leadership guaranteed the survival of freedom, the liberation of Eastern Europe and the defeat of Soviet totalitarianism.”

·         “For the better part of a century, security and freedom for millions of people around the globe have depended on America’s military, economic, political and diplomatic might.”

·         “As citizens, we have another obligation. We have a duty to protect our ideals and our freedoms by safeguarding our history. We must ensure that our children know the truth about who we are, what we’ve done…”

The Vice President is disingenuous in his promotion of that final truth.  He ignores the truths of what his Administration did to our country: Waging meaningless wars, sacrificing thousands of young people to false causes, leaving hundreds of thousands more maimed, our economy weakened, our surplus drained, our national reputation and credibility badly tarnished.

For instance, in proclaiming that the President “has abandoned Iraq, leaving a vacuum that is being tragically and ominously filled by our enemies,” he declines to acknowledge that the devastation and lawlessness that defines Iraq today is the direct result of a groundless – senseless - war that he himself engineered. 

Cheney’s war fundamentally demolished whatever shaky stability existed in the region at the time, facilitating the rising threats of Iran and Isis, and, we should not forget, obscenely bolstering his own personal wealth.

The Cheney op-ed goes on to make repeated references to the American “supremacy” that defined the bi-polar world that existed before the fall of the Soviet Union, steadfastly ignoring the multi-polar world that emerged in its wake, driven, in part, by the years of American-won (relative) peace and prosperity during the succeeding decade defined by the U.S.-led global Internet boom.

Instead, clinging desperately to yesterday’s concept of American exceptionalism, Cheney rejects the fundamental geopolitical realities inherent in a multi-polar world, demanding that America somehow re-birth Cold War preeminence, cramming yesterday’s two-dimensional square peg exceptionalism into today’s far more complex multi-dimensional round hole.

In this context, he blasts Obama:

“…despite the explosive spread of terrorist ideology and organizations, the establishment of an Islamic State caliphate in the heart of the Middle East, the proliferation of nuclear weapons, and increasing threats from Iran, China, North Korea and Russia, President Obama has departed from this 75-year, largely bipartisan tradition of ensuring America’s pre-eminence and strength.”

Wrong.

President Obama, in the context of the severe damage done to America’s reputation and prestige over the eight years of Bush-Cheney rule, has been working to re-establish America as a credible partner – an exceptional nation in a multi-polar world in which exceptionalism is not confined to our fifty States.

Indeed, Cheney is actually spot on when he writes:

“ As America faces a world of rising security threats, we must resolve to take action and shouldn’t lose hope. Just as one president has left a path of destruction in his wake, one president can rescue us. The right person in the Oval Office can restore America’s strength and alliances, defeat our enemies, and keep us safe. It won’t be easy. There is a path forward, but there are difficult decisions to be made and very little time.”

This is what Obama has been charged with for the last seven years.  And, to some limited extent, he has achieved success.  America is indeed an exceptional nation, but, in a multi-polar world, we must accept and work with peers on the global stage.

Like the former Vice President, I hope that whichever candidate prevails in 2016 can pick up and carry this standard further forward.  Borrowing again from Mr. Cheney, this will be best and perhaps only accomplished if, unlike the Vice President, we “ensure that our children know the truth about who we are, what we’ve done…”

Cyber-curing what ails us will demand global remedies

Earlier this week (January 13, 2015), President Obama unveiled a slew of proposed cybersecurity-related initiatives, ranging from updated cyber-information sharing legislation to empowering and re-tooling law enforcement to battle cyber-crime; from new data breach reporting requirements to a February 2015 White House Summit on protecting consumers online.

These are all laudable initiatives, indeed, necessary initiatives (although, in light of countless Snowden-unveiled tidbits over the last couple of years, I have my worries about overly-broadly better-empowering law enforcement which, in cahoots with U.S. intelligence agencies, seems to have demonstrated a frighteningly consistent pattern of abuse of such power).

But, to some extent, these proposed initiatives all miss the broader and more critical point: Cyberspace is global, borderless. And, so too, is cyber-malice.  Thus, until and unless the Administration devotes similar – indeed, more forceful - attention to identifying and agreeing globally-applicable disciplines, domestic remedies such as proposed may be challenged to succeed, at least in the grand cyber-scale of things.

Yes, the proposed information sharing legislation would enable the public and private sector to better exchange information about and better analyze, understand and effectively address cyber threats, as well as better safeguard Americans’ personal privacy through the institution of stricter requirements for private companies that collect or use personal data.

Yes, modernizing the legal ecosystem to allow for the prosecution of the sale of things like spyware used to stalk or commit ID theft, as well as the criminalization of the overseas sale of stolen U.S credit card and bank account numbers, and the granting of authority to courts to shut down botnets engaged in DDOS attacks and other criminal activity, are all good and necessary things.

Yes, simplifying and standardizing existing State laws that require businesses to notify consumers of data breaches and corralling them into one Federal statute should indeed serve to both better incent businesses to upgrade their cybersecurity and, thus, better stem the tide of identity theft, financial compromise, etc. 

And, yes, the proposed February 13 “White House Summit on Cybersecurity and Consumer Protection” at Stanford - which will include Administration leaders, CEOs from a range of industries, law enforcement representatives, consumer advocates and technical experts – cannot help but contribute constructively to better educating and protecting American consumers and companies.

These initiatives all seem to acknowledge the need to restore consumer and corporate trust in the networks that power our digital lives and livelihoods, as well as the integrity of the data that funnels through or resides in such networks.  This is a good thing (notwithstanding that the initiatives seem to utterly ignore widespread concerns related to U.S. Government domestic surveillance, espionage, etc.).

While a “fortress America” approach to cybersecurity might be a welcome panacea for the masses, it is insufficient to deal with more global and more potentially devastating cyber-threats, whether Government-spawned malware like Stuxnet, massive-scale DDOS attacks, the theft of billions in intellectual property, or, the big fear, the disruption or destruction of critical infrastructure.

Pre-Snowden, the Administration was quite bullish on setting and enforcing global cyber norms and standards.  As Snowden’s Revelations have wreaked havoc on America’s cyber credibility, the U.S. seems to have hunkered down, shying away from the lead on global solutions, and, by virtue of that seeming withdrawal, to some extent actually perpetuating global insecurities and vulnerabilities.

This week’s White House announcements were heartening, and, hopefully, will lead to an improved State of the cyber-Union, as well as some level of restored confidence in the integrity of networks and data.  However, these initiatives are but domestic pieces of a much bigger global puzzle, the completion of which should remain of the highest priority to U.S. authorities if the domestic initiatives are to be truly meaningful in the long-term.

Fun With Facts: The Gertz Edition

Two days ago, the online radical conservative publication The Washington Free Beacon featured an article authored by Sino-phobe and habitual Huawei-basher Bill Gertz. 

Titled “Congress Targets Chinese Telecom Threat,” Gertz’s piece vomits up copious amounts of Huawei FUD and slander in its hyper-maniacal applause for a pair of Congressional amendments which, while setting trade-distorting precedents like-as-not to be used against American companies overseas, probably won't achieve much in terms of addressing any legitimate national security concerns.

Let’s parse through this turd of an article:

(And, lest anyone forget, Huawei is my employer, but the words, sentiments and opinions in this blog are mine and mine alone, unvetted by anyone).  

Gertz’s words are in italics, my observations, in bold:

Current House intelligence and defense legislation now before Congress is seeking to block U.S. intelligence officials from working for Chinese-linked companies, and also is aimed at preventing a major Chinese telecommunications firm from conducting cyber attacks against defense and intelligence networks.

“Chinese-linked companies?”  Uh…  In terms of the information and communications technology industry, that’s pretty much everyone.

Two amendments now part of the fiscal 2015 intelligence and defense authorization bills target China’s Huawei Technologies, a company linked by the U.S. government to electronic spying, although the company is not named specifically in the legislation, members of Congress and aides said.

The intelligence bill amendment would prevent former U.S. intelligence officials from joining companies like Huawei, which the U.S. government has linked to China’s military and illicit spying through its network equipment.

Except that is not the case.  First off, the U.S. Government has, in fact, never – never – cited a shred of credible evidence of any unusual link between Huawei and any government, nor has there ever been any allegation of illicit spying through Huawei network equipment or otherwise.  Being gracious, the USG has at most suggested only potential or prospective concerns. 

Indeed, with all of this in mind, and as explained to Gertz in an email exchange in advance of the publication of his article, the “covered entity” definition in the intelligence bill amendment in no way, shape or form applies to Huawei.  No-one – no-one – has ever once – not once – offered a shred of credible or substantive information to suggest otherwise.

The defense bill amendment would require the director of national intelligence and secretary of defense to report to Congress on all bids by foreign telecommunications companies seeking U.S. contracts.

Both measures are being dubbed the Rogers’ amendments after their Republican sponsors: Rep. Mike Rogers of Michigan, chairman of the House Permanent Select Committee on Intelligence; and Rep. Mike Rogers of Alabama, chairman of the House Armed Services subcommittee on strategic forces. “I am greatly concerned Chinese-government-controlled telecommunications companies could pose a direct threat to our national security,” said Rogers of Alabama who sponsored the defense amendment.

“We need to make sure we’re protecting all levels of our infrastructure,” he said. “This is an issue that affects big cities, small towns, and military bases in every corner of the U.S. and those overseas as well.”

These seem like legitimate concerns.  But contrary to Gertz’s or anyone else’s willfully uninformed opinion, Huawei is not “Chinese-government controlled,” so, as pointed out to Gertz via email before his article ran, the amendment has no relevancy to Huawei.

And, as further communicated to Gertz by email, the defense bill amendment is extremely worrisome in terms of its very broad and trade-distorting precedent-setting nature.  In this context, I commented to Gertz: “…One can only hope that a responsible, rational and transparent process will be developed and communicated to explain how a finding of “suspected of being influenced” might be made, and that strict and rational and transparent rules will be developed to define the character and fact-based validity of the substance of the required “Elements of Notification” (section c, 1-3).  Otherwise, the risk of generating copycat techno-nationalist like policy, law or regulations in other markets is great, and to the detriment of U.S. businesses operating overseas.”

Both amendments passed the House last month and now face House-Senate conferences.

Huawei spokesman Bill Plummer declined to comment on the legislation.

Well, I did offer the observations noted above, but Gertz seemed to have little interest in alternative perceptions.   He is correct, however, that I did not offer any official Huawei on-the-record comment – I mean, really, why would any company dignify this nonsense with a response?

Rep. Frank Wolf, (R., Va.) said he supports both measures, and specifically the intelligence employees restriction. Wolf was the first to reveal last year that Huawei had hired Theodore Moran, who worked on two government intelligence advisory panels at the same time he was paid consultant for the Chinese company.

“I think it’s good amendment and it’s a problem I think neither [Republican or Democratic] administration has addressed,” Wolf said in an interview. “When you get a guy connected to some of these groups who comes in and advises an administration on public policy, it’s not a good idea.”

Ah yes, Representative Wolf…  Another unabashed basher with questionable interest in the facts.  But hey, I'll give credit where credit is due: At least this time he didn’t reference George Clooney (for more on this and to put Rep. Wolf’s opinions in perspective, please see my April 29, 2012 blog post). 

Susan Phalen, a spokeswoman for the House intelligence committee, said the amendment is needed to protect secrets. Senior intelligence officials gain access to the nation’s most sensitive secrets during their careers, she said in an email.

“This provision would help avoid conflicts of interest or the appearance of impropriety in post-government employment funded by governments that pose a high counterintelligence threat to the United States,” Phalen said. “These limits are analogous to the restrictions on executive and legislative branch employees who seek to lobby the federal government after they leave public service.”

I’ll leave her alone. She’s just a mouthpiece.

The global Chinese telecommunications equipment maker is widely viewed within the U.S. intelligence and military communities as an arm of the Chinese government that is engaged in clandestine intelligence collection through its equipment.

Nonsense.  There has never – never - been any USG claim that Huawei is “an arm of the Chinese government,” nor that the company is “engaged in clandestine intelligence collection through its equipment.”  As stated earlier, any ill-founded or politically-inspired concerns have virtually always been prospective.

The Pentagon’s annual report on the Chinese military has linked Huawei to Beijing’s People’s Liberation Army (PLA). “Information technology companies in particular, including Huawei, Datang and Zhongxing, maintain close ties to the PLA,” a report several years ago said.

Yawn.  ‘Been reading this bullet since the 2005 Rand Report introduced the fallacy.  There is zero evidence to back it up. Never has been.

The first Rogers amendment is a response to the case of a senior adviser to the Director of National Intelligence (DNI), Theodore Moran, who worked for DNI as an adviser at the same time he was a paid consultant to Huawei.

The provision prevents all U.S. intelligence officials with access to sensitive compartmented information, the most secret classified information category, from working with suspect foreign companies for a period of one year after leaving government. For two years following retirement, covered intelligence officials cannot work for an outside foreign company on any matter relating to their work for spy agencies during the last year of employment.

It also would require former intelligence officials to report to their former agencies any payments received from suspect foreign employers.

Both requirements would be imposed for five years.

Seems reasonable.

The measure also requires the designation of certain governments that that are classified as “a significant counterintelligence threat,” such as China and Russia.

The Obama administration, according to observers, has been lax in pursuing foreign intelligence agents. Since the 2010 arrests of 10 Russian undercover agents, the administration has not apprehended a single significant foreign spy.

The second Rogers amendment calls on the defense secretary and DNI to notify Congress if every foreign-influenced company or its affiliate “is competing for, or has been awarded a contract” that could impact military or intelligence systems.

To the point I made to Gertz in our email exchange, how might “foreign-influenced” be determined?  Based on facts?

The legislation specifies the networks as “information technology or telecommunications networks of the Department of Defense or the intelligence community; and information technology or telecommunications networks of network operators supporting systems in proximity to Department of Defense or intelligence community facilities.”

A U.S. official said the provision is aimed at preventing companies like Huawei from infiltrating rural U.S. and other networks through sales of equipment to local telecommunications firms, as has occurred in the past, in an effort to avoid federal security scrutiny.

“Infiltrating?”  “An effort to avoid federal security scrutiny?”  Good grief. Huawei has been operating openly in the United States since 2001, serving a number of carriers, rural and otherwise, as a result of open and competitive bidding processes. 

“We’ve seen Huawei go under the radar in seeking to infiltrate rural providers,” the official said. “We have to be careful that we don’t wake up in five years and find that 20 percent of the country is using Huawei equipment.”

“Under the radar?”  See above.  Who is this shallow, duplicitous scare-mongering “official” that Gertz is quoting? 

The amendment also was written broadly enough to capture the recent deal between Huawei and South Korea’s LG that has raised concerns about the security of U.S. military communications in a potential war zone.

U.S. intelligence and military officials have said allowing Huawei to build a South Korean network could compromise U.S. military communications in a future conflict on the Korean Peninsula.

Chris Bush, a spokesman for the U.S. Forces Korea, told the Free Beacon last month that the command is concerned about the contract between Huawei and the South Korean company LG as a potential security problem.

“Telecommunications equipment is inherently vulnerable to a multitude of threats, from interception and monitoring to malicious software and applications, regardless of service provider,” Bush said in response to questions about the Huawei-LG deal.

Hey. Wait…

“Telecommunications equipment is inherently vulnerable to a multitude of threats, from interception and monitoring to malicious software and applications, regardless of service provider…” 

Spot on Chris.  I mean, the NSA has certainly proven this point, and, further, has demonstrated that it doesn’t matter which company built the gear, nor where any company may be headquartered.

Rogers of Michigan said earlier this year that he opposes permitting Huawei to set up a telecommunications network in South Korea.

“Allowing Huawei equipment into South Korea’s advanced wireless network could create dangerous operational security vulnerabilities for the U.S. and South Korean military and government personnel who will inevitably use this network,” Rogers said.

"Intelligence" Committee Chairman?  Really?  

Huawei is supplying commercial telecommunications infrastructure equipment built to open and globally-specified technical standards for deployment by a commercial operator in a commercial network in South Korea.   

Really Mike?  Our military and government are sending secure communications over open commercial wireless networks?

The defense amendment would require the DNI to report to Congress annually on whether suspect foreign companies are competing for or were awarded contracts related to information technology or telecommunications components.

“Suspect?”  See comments above about “foreign-influenced.”

The U.S. government has blocked Huawei three times since the early 2000s from buying or merging with U.S. telecommunications firms over spying concerns.

Australia has also blocked Huawei from doing business there and Britain’s government has set up a special security panel to review Huawei equipment used in Britain’s networks.

Dead wrong.  Yes, the Australian government - under strong pressure from the U.S. government – blocked Huawei from a government-sponsored broadband network, but otherwise, Huawei is a major supplier of commercial communications network gear in Australia, and in the UK, where the government has taken a commercially rational approach to legitimate security concerns.

A House Permanent Select Committee on Intelligence report in 2012 identified Huawei and another Chinese telecom firm, ZTE, as security threats that could facilitate electronic spying by the Chinese government. The report concluded that U.S. companies should not use any Chinese gear in networks.

The House report also warned that other infrastructures, including electric power grids; banking and finance systems; natural gas, oil, and water systems; and rail and shipping channels all could be compromised by penetrating computerized control systems.

The HPSCI report is almost universally recognized as vapid, utterly vacant, its findings and recommendations ungrounded by even basic facts.  Look, don’t take my word for it, read it - then you will understand why The Economist labelled it “a report for vegetarians” (no meat).

An open-source U.S. intelligence report from 2011 said Huawei was linked to the Ministry of State Security, the civilian political police and intelligence service, through one of its executives.

The CIA-based Open Source Center report said Huawei’s chairwoman, Sun Yafang, worked for the Ministry of State Security (MSS) Communications Department before joining the company. The report said Sun used her connections at MSS to help Huawei through “financial difficulties” when the company was founded in 1987.

Stuff and utter nonsense, and Gertz knows it.  The Open Source Center report is nothing other than a non-classified regurgitation of articles in the open media, including, in one instance, a mis-informed report in an obscure Chinese online publication that was later retracted, but only after it had been picked up by other media. 

China’s government has paid Huawei more than $220 million for research and development in the past decade.

Yawn.  This is information openly available on Huawei’s website.  Huawei gets commercial R&D grants from governments around the world, as do Huawei’s Western-based peers, including from the Chinese government. Such grants make up a miniscule fraction of Huawei’s annual $5+ billion in R&D investment.

The OSC report, dated Oct. 5, said Huawei’s senior leaders have “connections” to the PLA. Huawei founder Ren Zhengfei worked for China’s military from 1974 to 1983 in the engineering corps.

I can barely bring myself to bother on this one.  “Connections?”  And even Gertz puts it in quotes.  And yes, Huawei’s founder was in the military three decades ago.  Big whoop.

Huawei’s headquarters is located in Shenzen, China, the companies has plans for facilities in 10 U.S. cities.

Gertz fails to get even the most basic facts straight: Huawei has been in the U.S. since 2001 and already has facilities in over 10 U.S. cities.

Surveillance Competition, Take Two...

Two days ago, I blogged on the recent revelation that U.S. intelligence agencies have been intercepting American-made routers and servers and inserting backdoors so that they can penetrate networks in markets in which the gear is deployed (link to my May 13 post).

Since then, the story has continued, including with ars technica running photos yesterday of busy beaver agents “upgrading" Cisco routers at a “secret location” (link).  No shit.

In the post I made a couple of days ago, borrowing from Glenn Greenwald’s Monday unveiling of the NSA’s export interception hijinks (link), I tied the new revelation to the politico-protectionist market access barriers that my employer Huawei Technologies has experienced in the U.S.

Following, is my nutshell synopsis of what’s been going on and why the U.S. Government has been blockading Huawei at home, and attempting to blackball the company abroad (Australia, South Korea, etc.):

Over the last few years, Huawei has grown to become either the leading or number two telecommunications infrastructure provider globally, with Huawei routers and servers and other gear becoming commonplace across the planet.

This turn of events has made the NSA’s eavesdropping practices ever-so-slightly more challenging.  It is far easier to re-route U.S. exports through “secret locations” for beacon-implants than to similarly compromise Huawei gear shipping from elsewhere to elsewhere.

Nevertheless, the NSA has attempted to maintain its overwhelming surveillance footprint through its Shotgiant program which, among other things, stole Huawei proprietary product info with the intent to compromise Huawei gear where deployed (link to my March 25 post on the topic), but it would seem this is a far less efficient model than surreptitious interception and “upgrade” of outbound U.S. exports.

What do to, what to do?

Impede Huawei’s global business. Stymie and attempt to roll back Huawei’s worldwide share so that the NSA's eavesdropping activities could be most easily and broadly managed.

How?

Demonize the company, starting with the U.S. market blockade, then extending to arm-twisting in foreign markets.  The blockade was key.  If Huawei had been allowed an even marginally-significant footprint in the U.S., it would have both furthered the company’s global success and market share, and undermined U.S. Government smear and blackball campaigns in other markets.

I’m not sure this policy is working.

The U.S. strong-arm tactics had some success in Australia, in terms of Huawei not being considered for the government-sponsored national broadband network (NBN) project, but they haven't prevented Huawei from successfully serving Australian commercial network operators.  And, more recent U.S. Government attempts to undermine competition and choice in South Korea seem to have fallen flat altogether.

Worse yet, this week’s revelations from Greenwald may well have yet further adverse impact on the overseas prospects for networking gear from U.S. suppliers, yet further hampering the NSA’s ability to conduct surveillance (not to mention wreaking some potentially not-insignificant commercial havoc for the victimized companies).

Look, I’m not saying that the U.S. government should not be engaged in espionage and intelligence-gathering that is critical to maintaining our national security (although I would observe that the domestic overreach that the Snowden Revelations have detailed over the last 11 months is truly reprehensible).

But the policy and practices have failed, both in terms of the exposure of the NSA’s compromise of U.S. Internet and telecommunications service providers and, as recently learned, ICT gear-makers as well, but also in terms of demonizing a world-respected ICT leader like Huawei (and in so doing also depriving American service providers and consumers of innovative and competitive broadband equipment alternatives).

It’s time for a reset.  Across the board.

While we’ve not likely heard the last from Snowden, et al, the crisis of confidence in the ICT industry is reaching a fever pitch. At stake is a global and interdependent economy that increasingly relies on digital and virtual tools and processes.

It’s time for industry and governments to come together to restore confidence in network and data integrity and security – in the Internet itself – and to do so in a rational, pragmatic, and non-political fashion.   See any number of my posts over the last year for thoughts on how this might happen.

Surveillance Competition (Greenwald Coins a Phrase)

Yesterday, coinciding with the release of his new book No Place to Hide, one-time The Guardian columnist Glenn Greenwald ran a swan song piece in his former employer’s publication titled “how the NSA tampers with US-made internet routers,” heralding the far broader content featured in his book.

In keeping with the trend of recent Snowden Revelations (e.g. drifting away from highlighting ongoing U.S. intelligence agency abuses against American citizens), Greenwald’s piece focused on exposing the NSA’s practice of covertly implanting interception tools in U.S. information and communications technology (ICT) equipment heading overseas.

Surprise.

Not.

The initial Snowden Revelations focused on U.S. intelligence agency compromise of unwilling but sadly witting American internet service and telecommunications providers.  It was really only a matter of time until we were to learn that they went after gear-makers and hardware as well. 

We got a sneak peek at this type of activity in March when Der Spiegel and The New York Times reported on the NSA’s Shotgiant program.  Shotgiant not only penetrated the corporate networks of global ICT industry leader Huawei in order to monitor its confidential communications, but also to steal proprietary product information with the intent to use such information to compromise networks into which the Huawei gear would be deployed.  Link to my blog post on Shotgiant.

(Aside: Lest anyone forget, I work for Huawei)

What Greenwald unveiled yesterday was that not only had American service providers been compromised, but, so too had the ICT hardware and related product of American-based companies. 

Per Greenwald, as per NSA documentation leaked by Snowden: “The NSA routinely receives – or intercepts – routers, servers and other computer network devices being exported from the US before they are delivered to the international customers.  The agency then implants backdoor surveillance tools, repackages the devices with a factory seal and sends them on. The NSA thus gains access to entire networks and all their users.”

Interestingly, Greenwald reports on the NSA’s shenanigans in the context of highlighting that what the NSA has been doing is exactly what U.S. Government entities have consistently yet groundlessly scare-mongered might be done through Huawei equipment.

In the wake of Greenwald’s article, media reports, social media and other conversations feature some surmising that U.S. intelligence agencies were looking in the mirror, observing their own actions, and presuming that the Chinese Government was doing the same thing with China-based companies.  Hence the blockade of Huawei, always accused of but never proven to be potentially complicit. 

But wait.  That assumption doesn’t make sense. 

Greenwald’s account, and subsequent reporting (e.g. see Wall Street Journal article), seem to indicate that the U.S. vendors whose product was violated were not in fact involved with or aware of the violation, rather, that the NSA was covertly snagging outbound exports and then infecting them with whatnot to enable whatever before sending them off on their merry way.

Who knows, we may one day come to learn that the U.S. vendors were indeed complicit, but I very highly doubt it.  It is extremely difficult to imagine the vast conspiracy that such complicity would entail. 

Consider: It was one thing for the NSA to compromise unwilling (for the most part, I believe) service providers - via tidy, manageable conspiracies of the C-suite and legal office - to enable the massive siphoning of data.  It's another thing altogether to compromise tens or hundreds of thousands of routers and servers.  That conspiracy, which would require the complicity of countless employees across a vendor’s organization, would be neither manageable nor sustainable.

The surreptitious interception and infection of outbound product “at the border” which Greenwald and subsequent reporters describe would seem a much better way to get backdoors installed, and would certainly be a lot less prone to information leaks and opposition that would arise in terms of working with complicit vendors.

Which brings us back to the U.S. Government’s opposition to allowing Huawei to compete in the U.S. 

If I am correct that the U.S. vendors were not knowingly compromised, and for the reasons I’ve laid out, then I think it’s pretty fair to assume that the U.S. Government knew full well that Huawei being wittingly compromised by the Chinese Government was also highly unlikely and certainly unsustainable.  Just as was the case with the unwittingly compromised American ICT exporters, it would require a conspiracy far too vast across a very global and very diverse employee population.

So why the Huawei blockade? 

Well, as some have already mused in the wake of Greenwald’s piece yesterday, perhaps because compromising Huawei gear being shipped to far-flung markets would have been a much more challenging endeavor than intercepting and infecting American-made gear.

Greenwald said it better:

 “Warning the world about Chinese surveillance could have been one of the motives behind the US government's claims that Chinese devices cannot be trusted. But an equally important motive seems to have been preventing Chinese devices from supplanting American-made ones, which would have limited the NSA's own reach. In other words, Chinese routers and servers represent not only economic competition but also surveillance competition.”

Later…

Ancient Cables and Dutch Treats

I recently stumbled across an almost ten-year-old cable from the U.S. Embassy in The Hague back to the State Department in Washington.  Classified “Secret,” the document now resides openly in the ether, courtesy of Wikileaks.

Two careers ago, I had some experience with drafting such cables as a Foreign Service Officer posted in Latin America, with additional service in Europe and Washington (a “cable,” incidentally, is a fancy word for what passes as an email in today’s parlance, the former simply pre-dating the latter, and the word lives on).

Generally speaking, the Officer drafting the cable has carte blanche and is trusted to capture his or her recollections of an event or observations on a topic, subject to the editorial review of senior officers for either substance or tone or both.

Once the cable is sent and distributed, it and its content take on the nature of “fact.”

What struck me about this particular cable was the fact-based reporting of a remarkably non-fact-based interaction between U.S. and Dutch Government officials.

According to the cable, Embassy staff were joined by U.S. Commerce and Defense Department export control officials in briefing Dutch officials from the Ministries of Foreign Affairs, Economics and Defense on a U.S. Government “non-paper,” about which no detail is provided in the cable.

We can divine, however, by the subsequent reporting on the Dutch officials’ response, that the U.S. delegation and the mystery non-paper were focused on (wait for it regular readers) disrupting the international supply chain of China-based technology companies, including Huawei, my ever-beleaguered employer.

It seems that the Dutch, with global commercial realities in mind, took the time to explain to the U.S. delegation that Huawei was a major global telecom gear manufacturer and a customer of Dutch suppliers, of, e.g. analog-to-digital converters (ADCs). 

Quoting from the cable: One of the Dutch representatives “…thanked the U.S. side for its information and remarked that Huawei, for example, was among the largest telecommunications base station manufacturers in China and a probable Philips customer.”

The U.S. side was quick to counter that “firms that are established ‘defense contractors’ to the PLA and have extensive ties to PRC national security agencies cannot be...trusted…”

I have no doubt that there is some truth to that concern.  But Huawei, in the world of facts, is demonstrably no such firm.

The U.S. went on, however, to comment that “the only companies that can be trusted… are those that are strictly focused on the civilian market... “

Ding, ding, ding…  Now that little descriptive would, in fact, apply to Huawei.

But facts be damned.

So, what’s my point?  Simply put, that mis-informed – albeit quite possibly intentionally so – U.S. Government representatives have been spreading Huawei FUD for the better part of a decade, and, each and every time they’ve done so, they’ve contributed to an ever-bloated body of “facts” built on little more than bullshit.

But God bless the Dutch.

Commercially rational, and in the context of sound and fair regulatory policy, the Dutch, per the cable, explained their plans to require “ADC buyers to track and account for their ADC inventory, rather than prohibiting altogether ADC sales to certain companies."

Further from the Dutch Government representative: ‘It would be hard,’ he concluded, ‘to shut out Huawei, one of the biggest players’ in China's third generation cell phone program…With this in mind, the GONL had been drafting sales contract language requiring 14-bit ADC buyers to put parts control programs in place for the converters.”

Ten years later, belated applause…

(Link to the cable: http://www.wikileaks.org/plusd/cables/04THEHAGUE3156_a.html)

America’s Cyber-Contortionist (and Free Trade Champion? – Not)

Just a few days ago, cyber-security specialists and senior government representatives met in Germany at the 50^th annual Munich Security Conference.  

Since 1963, the MSC has served as “an independent forum dedicated to promoting peaceful conflict resolution and international cooperation and dialogue in dealing with today’s and future security challenges.” (More at: https://www.securityconference.de/en/).

Needless to say, in recent years, the MSC has focused on security challenges in the realm of cyber.  This year’s sessions were no different.  One session in particular stood out for me: The January 31 Panel Discussion focused on: "Rebooting Trust? Freedom vs. Security in Cyberspace."

The President of Estonia made an opening statement, and then the CEO of Deutsche Telekom introduced the panelists, including the German Minister of the Interior, the EU Commissioner for Home Affairs, Microsoft’s VP of Security, Huawei’s Chief Security Officer (reminder: Huawei is my employer), and the Chairman of the U.S. House of Representatives Permanent Select Committee on Intelligence (HPSCI), Mike Rogers. 

The panel was moderated by the President of the EastWest Institute, an organization founded in 1980 which “seeks to make the world a safer place by addressing the seemingly intractable problems that threaten regional and global stability.” (More on EWI at http://www.ewi.info/).

Generally speaking, the panelists (almost all) acknowledged the shattered trust in the information communication technology industry (and select governments) in the wake of the Snowden revelations.  Likewise, the panelists (most) detailed possible steps towards restoring confidence.

One panelist, however, stuck out like a sore thumb (one cannot imagine the countless phrases I considered and rejected for that analogy): Chairman Mike.

Go figure.

Mike opened with an acknowledgment that there is “a trust issue,” but pondered aloud about why the group was really gathered: “Damaging classified information that was leaked?  Maybe so.”  But, Mike thinks not.  Indeed, Mike commented that he was “a little surprised” that people were talking about “the problems with the NSA.” 

The Chairman then transitioned into scare-mongering about Iran, North Korea, Russia, China, etc., oozed into an explanation that reports of U.S. spying on French phone calls were misrepresented, and, subsequently, segued to his key mis-direction of the day:  

“The most recent release of information…the United States engages in economic espionage…I have been on the oversight committee doing oversight for our 16 intelligence agencies…for the last ten years…It is against the law in the United States to use our intelligence services for industrial espionage…If they do it, they are going to jail. Period. End of story.” 

Now that’s only part one of the mis-direction, but let’s take a brief time-out to consider it.

Last September I posted on Mike’s utter failure to conduct the oversight with which he is charged (link), so I won’t belabor that point.  But, since he has raised laws and jail, let’s hold him to it: If future revelations show that such industrial espionage did take place, then Mike, by virtue of his position, is aware of and as such complicit to such “illegal” activity and he should be summarily incarcerated…

…But let’s get back to the Chairman’s key mis-direction, part two:

Per Mike: “Now wouldn’t you find it interesting that that information was released at a time when we’re trying to arrange a trade arrangement that I think benefits both Europe and the United States…  I do…”

This little nugget doesn’t get fully matured until the Q&A session, but, the gist: The Russians are managing Snowden in order to time his revelations to tank U.S.-EU Free Trade talks.

In the Q&A session, Mike hammers it home: “I think it’s a huge mistake to allow this issue…to step in the way of a trade agreement between Europe and the United States.  These are two very separate issues…but by tying them together I will guarantee you that you will see more disclosures like we saw last week that the Americans engage in economic espionage…” 

He went on: “You’re gonna see more of that because it breeds distrust – the Russians have a specific purpose for driving a wedge between us and our European allies.”

The Chairman is wrong.  

Not in terms of our seeing further revelations, but in terms of his interpretation of the “tie” between European privacy concerns and the U.S.-EU Free Trade talks.

Europeans have every right to consider privacy protections in the context of U.S.-EU Free Trade negotiations – the former might (albeit unlikely) serve as leverage towards achieving some sort of protections in the context of agreeing the latter, although not likely in the actual substance of any trade agreement.  That is a legitimate tie.  Mike’s suggestion that the Russians are somehow orchestrating the tie borders on absurd.

It gets worse.  Following his initial suggestion that the Russians are orchestrating revelations, and in advance of his Q&A session elaboration on this point, Mike goes on to propel himself headlong into a trap he has set for himself more than once in recent months: 

In defending the integrity and due process of U.S. espionage activities, the Chairman refers to “an oversight mechanism that is not seen anywhere else in the world.  Our judicial branch, our…legislative branch, and our executive branch have to go through an approval process for these activities… that is an important distinction and we argue that is our transparency.”

Sigh. 

Really?  That reference, and the Chairman’s subsequent Q&A session reference to the FISA court and 4^th Amendment protections, are both to processes that only apply to American citizens, and, seemingly, only within U.S. borders, and, from what we have had revealed to us by Mr. Snowden, perhaps not at all. 

One thing is certain though: Europeans and other non-Americans do not benefit from any such oversight or Constitutional prophylaxis (as was pointed out by one clued-in questioner).

C’mon Mike. C’mon America.  Is this the best we have, is this the best we can do?  

(Link to video of the full 1.5 hour panel discussion)

Huawei, the NSA, HPSCI and Lies

Today, Germany's Der Spiegel reported on the latest wave of NSA Revelations (the provenance of which are unclear, but presumably they are Snowden-sourced).

According to the Der Spiegel article (link to GigaOm coverage in English), the most recently unveiled information indicates that the U.S. National Security Agency (NSA) was not only successful at compromising sometimes-witting-but-almost-certainly-unwilling American telecom and Internet service providers, but also at compromising American and non-American telecom and Internet infrastructure hardware and solution providers, without their knowledge.

Through what appears a combination of software hacking and cracking (and, possibly - from my personal perspective - infiltration and tampering with American components, chip-sets, etc. that feed into multinational company supply chains), the NSA has seemingly extended its global surveillance and information dragnet well beyond what had been previously reported, or even imagined.

One of the companies whose gear was reportedly compromised is my employer Huawei.  The irony of this situation could not be richer (Reminder: this is a personal blog reflecting my personal thoughts).

For the last few years, China-headquartered Huawei has been the victim of a U.S. Government-wide (and beyond) conspiratorial witch-hunt.  Vicious and baseless allegations have been made without end, with Huawei accused of being somehow financed, directed, controlled or otherwise uniquely vulnerable to Chinese Government cyber penetration and manipulation.  Wilder and weirder myth and misinformation has been spread, slandering the company and its employees in many and nasty ways.

Never, not once - not once - has there been a shred of substantive evidence presented to support any such allegations.

Now, while to the best of my knowledge Huawei has yet to validate or invalidate the vague suggestions made by Der Spiegel, let's for the moment imagine there is some truth to what's been unveiled.

In that context, let's consider last year's U.S. House of Representatives Permanent Select Committee on Intelligence (HPSCI) "investigation" of Huawei which concluded with the company branded - with zero substantive reason - as some sort of threat to U.S. national security due to being somehow uniquely vulnerable to potential compromise by the Chinese Government.

As much of a circus-like sham as the whole exercise was, it is all the more shameful in light of today's revelations.

Indeed, HPSCI Chairman Rogers - the man charged with overseeing U.S. intelligence activities to prevent abuse, who has instead spent the last six months trying to sugar-coat such abuse - has forever redefined the height of hypocrisy by accusing Huawei of being uniquely vulnerable to compromise by one Government when, as the Chairman of HPSCI, he was almost certainly aware, the U.S. Government had already achieved this feat (at least per Der Spiegel).

You know, in the immediate wake of the initial Snowden Revelations, some joked that the reason the U.S. Government was so hell-bent on keeping Huawei out of the market was because they were uncertain they could penetrate and compromise our solutions as easily as they might the gear of our American or other Western peers.

If Der Spiegel has it right, such lighthearted wit was dead wrong.

Indeed, if Der Spiegel has it right, the whole Huawei embargo and witch-hunt was nothing more than good-old-fashioned protectionism and China-baiting - the NSA has proven that it doesn't matter where a company is headquartered in terms of it's vulnerability to potential malicious penetration and compromise.

These most recent NSA revelations expose past U.S. Government representations about Huawei (and similar opinions from sycophants like my favorite CSIS cyber-gasbag, as well as military-industrial-complex fan-boy groups like the U.S.-China Economic and Security Review Commission) as utterly baseless and equally and maliciously and knowingly duplicitous

Moreover, if Der Spiegel has it right, they have confirmed rather solidly that cyber vulnerabilities are universal, agnostic to geographies, location of headquarters, flags or borders, and demanding of universal industry-wide solutions to address such challenges.

Huawei-related fuming aside, back home, it's time for some serious accountability...

From the Administration.  From the Congress.

U.S. intelligence agencies are now recognized - unequivocally - as the most advanced persistent threat to the integrity of global networks and data.

American standing on the world stage is lessened.

Our ability to project the values we have nourished and cherished for two-plus centuries is diminished.

We are increasingly distrusted abroad.  Such distrust extends to our businesses, and will quite likely yet further adversely impact our economy.

Where will the buck stop?

Enough already with the vacuous HPSCI report on Huawei

Just over a year ago, in October 2012, the U.S.House of Representatives Permanent Select Committee on Intelligence (HPSCI) issued an empty, vacant, slanderous report suggesting that $35 billion dollar multinational Huawei Technologies somehow presents a threat to U.S. national security.

The report - the result of a bad-faith 11-month "investigation" by the Committee - is laughable in terms of its utter lack of substance, and generally dismissed as garbage, and not just by people who actually understand the information and communications technology industry, but within the Beltway as well.

But the damned thing keeps getting referenced in media reports as if it had merit.  Check out the embedded 10 minute video which exposes the Committee's willful misrepresentations, point by point, and further details the costs of their tomfoolery.

Shame on you Associated Press, and you too Rep. Wolf

Just shy of 30 years ago, while a student at Georgetown, a roommate of mine had a professor who's kid played in a local recreational soccer league. His team was in need of coaches.  My friend and I, having both played soccer in high school, volunteered.  Good fun.

About a decade later, in the mid-90’s, when I was a mid-level Foreign Service Officer at the State Department in Washington, I re-encountered the professor, who was consulting in State’s Strategy and Planning Office.

Fast forward to 2010, when I was surprised to learn, after joining Huawei, that the professor – still at Georgetown – was a member of Huawei’s newly-minted International Advisory Committee, comprised of illustrious business, academic and other counselors. 

It is, indeed, a very small world.

Today, the Associated Press, in seeming-cahoots with Virginia Congressman Frank Wolf, did a hatchet job on Professor Moran.

In September of this year, after Congressman Wolf (R-VA) “discovered” that the professor was serving simultaneously on both Huawei’s International Advisory Committee and the U.S. Government National Intelligence Council (a group of private sector analysts and policy experts who advise the Office of the Director of National Intelligence on various matters, including foreign investment in the United States), he put pressure on the Director of National Intelligence and the professor was seemingly compelled to resign.

“Discovered?”  Hardly a feat, given that both advisory positions were prominently listed on the professor’s publicaly-available CV, and referenced in his various publications.

Nevertheless, Wolf is one known to give an Administration headaches, so the Administration, fully aware of the professor’s historical situation, bent over and forced the resignation. 

Now, Wolf himself has some justified concerns with China, but he also has an unfortunate and slightly-mad penchant for using Huawei, an independent $35 billion globally-trusted and proven China-headquartered multinational, as his proxy for China-bashing.  (Indeed, I would encourage you to pause in your reading this post and peruse my April 2012 post featuring one of Rep Wolf’s more lunatic tilts at the Huawei windmill before continuing).

Which brings us back to today’s Associated Press piece titled Chinese Firm Paid US Gov't Intelligence Adviser – a lurid and grossly-misleading headline.

Go on.  Read it.  You’ll see.  Headline and remarkably-intentional journalistic bias aside, the story is not news.   Huawei, like many companies, particularly multinational companies, has an international advisory committee.  And advisors are compensated.  Whoopee.  Go figure. 

But, uh oh, shudder, the professor also serves on a U.S. Government advisory committee.  So, shamelessly carrying Wolf’s dirty water, the AP blithely weaves conspiracy from whole cloth, intentionally misleading readers. 

Perhaps the most obvious example of shameless reporting: “In a policy paper distributed by Huawei, Moran wrote in May that, ‘targeting one or two companies on the basis of their national origins does nothing for U.S. security in a world of global supply chains.’ Moran criticized what he described as ‘a policy of discrimination and distortion that discourages valuable inward investment from overseas, while providing a precedent for highly damaging copycat practices in other countries.’”

Let’s parse this out.

First off, the policy paper being referenced by the AP is intentionally misrepresented by the AP as somehow being a Huawei or Huawei-commissioned product.  It is not.  In fact, it is a paper published by the Petersen Institute of International Economics, a world-respected economics and trade think tank where Professor Moran serves as a Fellow. 

Intentionally misrepresented?  Yes.  When the AP was asked to appropriately label the report, they declined, at the editorial level.

Now, let’s consider Professor Moran’s quotes from the policy paper:

“Targeting one or two companies on the basis of their national origins does nothing for U.S. security in a world of global supply chains.”

Spot.  On.   See below.

“A policy of discrimination and distortion that discourages valuable inward investment from overseas, while providing a precedent for highly damaging copycat practices in other countries.” 

Yes.  Exactly.   

Why on earth would the AP suggest such statements were somehow suspect?  It boggles the mind.  All the more so in the wake of the Snowden revelations that, by all indications, seem to be leading to a situation in which U.S.-based companies will suffer similar discrimination in foreign markets.

Shame on you AP for pandering to shallow, baseless, discriminatory politicians and policy.  Shame on you Rep. Wolf for driving this bullshit.   And shame on those in the U.S. Administration that continue to demonize Huawei by virtue of its heritage in China.

Again (borrowing from my post two days ago):

The Information Communications Technology (ICT) industry is transnational, essentially borderless. Whether you are Huawei, Cisco, Alcatel-Lucent or Ericsson you are operating world-wide, equally vulnerable to penetration or compromise, whether by the now-world-renowned experts at the NSA, or whoever their counterparts may be in China, Russia or Israel.   Knocking Huawei out of the market – any market – does precisely squat to secure networks and data.   And the U.S. Government knows all of this.

But (you might ask), hold on, wait a second, if the NSA compromised U.S. companies, then certainly the Chinese Government can compromise Huawei?

That analogy holds no water.  Let’s review:

The penetrations and compromises thus far unveiled by Edward Snowden were primarily achieved by U.S. intelligence agencies either compromising unwitting innocent companies or forcing unwilling (also innocent) companies into unfortunate complicity. 

In terms of the latter, from what we have learned to date, the bulk of the data syphoned off by the NSA, et al was primarily extracted from service operators or data managers under “legal” pretense.  Knowledge of such witting but unwilling compromise of these companies was almost certainly limited to a small few within the companies, perhaps just C-level and legal.

Huawei is a different kind of company. 

Think of the companies referenced above as water companies. 

Think of Huawei as a company that builds the pipes for the plumbing systems used by the water companies. 

The U.S. intelligence agencies went to the legal departments at the water companies and forced a spigot into their reservoirs, virtually draining them.  Again, it is quite likely that very few people within the water companies were even aware of the quiet conspiracy.

Contrast that with a company like Huawei. 

A quiet conspiratorial visit to the legal department or C-level arm-twisting won't do the job.

In order to compromise Huawei’s gear, you would have to infect each and every pipe (router, switch, etc.) which, given the volume of product we produce and the thousands of researchers, coders and builders involved – all around the world - would require an absurdly unbelievable and unsustainable conspiracy of countless employees spanning far-flung countries where research, coding and assembly take place.

But (you might ask), what about after-market “software upgrades” or “patches” or some other digital or magical manipulation of the gear after it’s been sold and deployed?

These are legitimate concerns.

But Huawei is not some *insert government name here*-directed operation in some non-descript building in Shanghai or Silicon Valley.  Huawei is a $35 billion company operating in 150 markets doing 70% of its business outside China, with state-of-the-art Research and Development and software facilities scattered across the globe.

Huawei “software updates” don’t just get “pumped out” willy-nilly.   They are deployed in close coordination with network operator customers and according to the security procedures defined by those customers.

Moreover, within Huawei, every line of code – wherever developed - is tracked and traced by “many eyes and many hands” (human and virtual) which, again, would mean that for Huawei to wittingly “pump out” “back doors” or “exploits” would again require a conspiracy of thousands of our employees, not to mention the additional complicity of employees of our network operator customers.

Absurd.

Could a rogue employee or group of employees plot cyber-shenanigans within the company? Yes.  This could happen at any ICT company - we are all vulnerable.  Yet, like any other world-leading ICT company with a reputation and business to protect, Huawei has employed robust disciplines to detect and quash such anomalies.

But a grand conspiracy?  Hogwash.

And the U.S. Government knows this.  And so should Rep. Wolf. 

And, as for the AP, we might grace them with not having the experience or bandwidth to understand the issues, but they should certainly have more journalistic integrity than to prostitute themselves to politicians…

Huawei, Korea, Pots and Kettles

Yesterday, the U.S. Administration and Senate leadership tag-teamed a stab at undermining the legitimate commercial activities of a China-based multinational in South Korea in order – seemingly (maybe?) – to give the Biden delegation visiting China some sort of additional leverage in bilateral talks, perhaps related to the increasingly-contentious “Air Defense Identification Zone” around the Diaoyu/Sanaku Islands.  

That’s how I see it.  

That, at least, would be a marginally rational explanation.  

The purported explanation defies logic.

Yesterday, the Wall Street Journal and The Daily Beast broke the story of a letter from the Chairs of the Senate Foreign Relations and Select Intelligence Committees calling on the Secretaries of State and Defense, as well as the Director of National Intelligence, to look into “the potential threats and security concerns” presented by Huawei’s involvement in a commercial wireless network deal...in South Korea.   

The Journal reported further that “the Obama administration is privately raising concerns with officials in South Korea about their plans to let a Chinese telecommunications giant develop the country's advanced wireless network, expanding a quiet campaign to warn key allies against integrating the Chinese technology into their systems.”

Okay.  C'mon already.  There should be zero possibility that anyone in the U.S. Government is legitimately concerned about unique network security or data integrity vulnerabilities associated with Huawei gear.  The facts are all too clear to the contrary.  Consider:

The Information Communications Technology (ICT) industry is transnational, essentially borderless. Whether you are Huawei, Cisco, Alcatel-Lucent or Ericsson you are operating world-wide, equally vulnerable to penetration or compromise, whether by the now-world-renowned experts at the NSA, or whoever their counterparts may be in China, Russia or Israel.   Knocking Huawei out of the market – any market – does precisely squat to secure networks and data.   And the U.S. Government knows all of this.

But (you might ask), hold on, wait a second, if the NSA compromised U.S. companies, then certainly the Chinese Government can compromise Huawei? 

That analogy holds no water.  Let’s review:

The penetrations and compromises thus far unveiled by Edward Snowden were primarily achieved by U.S. intelligence agencies either compromising unwitting innocent companies or forcing unwilling (also innocent) companies into unfortunate complicity.  

In terms of the latter, from what we have learned to date, the bulk of the data syphoned off by the NSA, et al was primarily extracted from service operators or data managers under “legal” pretense.  Knowledge of such witting but unwilling compromise of these companies was almost certainly limited to a small few within the companies, perhaps just C-level and legal.

Huawei is a different kind of company.  

Think of the companies referenced above as water companies.  

Think of Huawei as a company that builds the pipes for the plumbing systems used by the water companies.  

The U.S. intelligence agencies went to the legal departments at the water companies and forced a spigot into their reservoirs, virtually draining them.  Again, it is quite likely that very few people within the water companies were even aware of the quiet conspiracy. 

Contrast that with a company like Huawei.  

A quiet conspiratorial visit to the legal department or C-level arm-twisting won't do the job.

In order to compromise Huawei’s gear, you would have to infect each and every pipe (router, switch, etc.) which, given the volume of product we produce and the thousands of researchers, coders and builders involved – all around the world - would require an absurdly unbelievable and unsustainable conspiracy of countless employees spanning far-flung countries where research, coding and assembly take place.

But (you might ask), what about after-market “software upgrades” or “patches” or some other digital or magical manipulation of the gear after it’s been sold and deployed? 

These are legitimate concerns, though sadly, unfortunately, somewhat de-legitimized by the canned quotes from the Center for Strategic and International Studies’ persistently-resident cyber-gasbag that were featured in the Daily Beast article. 

Per The Daily Beast, the aforementioned “expert” said that “Huawei’s routers and switches may be clean at first. But the potential for back doors, or exploits within the software and hardware of the equipment, could be slipped into the gear through routine maintenance such as software updates.”  “They can pump out a software update and you have no idea what is in the software.”

Such hyperbolic paranoia (or perhaps just utter ignorance of the business realities in the ICT industry) borders on mind-numbing.

Huawei is not some <insert government name here>-directed operation in some non-descript building in Shanghai or Silicon Valley.  Huawei is a $35 billion company operating in 150 markets doing 70% of its business outside China, with state-of-the-art R&D and software facilities scattered across the globe. 

Huawei “software updates” don’t just get “pumped out” willy-nilly.  

They are deployed in close coordination with network operator customers and according to the security procedures defined by those customers. 

Moreover, within Huawei, every line of code – wherever developed - is tracked and traced by “many eyes and many hands” (human and virtual) which, again, would mean that for Huawei to wittingly “pump out” “back doors” or “exploits” would again require a conspiracy of thousands of our employees, not to mention the additional complicity of employees of our network operator customers.

Absurd.

Could a rogue employee or group of employees plot cyber-shenanigans within the company? Yes.  This could happen at any ICT company - we are all vulnerable.  Yet, like any other world-leading ICT company with a reputation and business to protect, Huawei has employed robust disciplines to detect and quash such anomalies. 

But a grand conspiracy?  Hogwash.

And the U.S. Government knows this.  

Which brings us back to the quest for a rational explanation for the odd concert of Administration officials and Senate Chairs attempting to interfere in the Korean commercial wireless marketplace.  I posited one such explanation at the outset of this post.  A placeholder of sorts.  Far-fetched?  

Maybe. 

But one thing we do know, it has nothing to do with network security or data integrity.  Indeed, that fig leaf is growing frightfully thin...