Safe Harbor, Jurisdiction, Parallel Construction and Pirate Radio

In response (in part) to the Snowden Revelations having undone trust in U.S. companies’ ability to ensure data integrity, the European Court of Justice (ECJ) today invalidated a 15-year-old data privacy pact that allowed U.S. businesses to “legally” transfer EU citizen data across the Atlantic, 

The EU's Charter of Fundamental Rights guarantees the protection of personal data.  In that context, until today, under the so-called “Safe Harbor” agreement, more than 4,000 U.S. companies “self-certified” that they met EU privacy protection laws, thus qualifying them to handle EU data. 

As of today, however, the ECJ rendered Safe Harbor invalid, due to, among other things, America’s global approach to digital surveillance and data collection, as well as the lack of adequate privacy protections in the U.S.

Meanwhile, related, the two-year-old Department of Justice (DOJ) case against Microsoft for refusing to surrender an individual’s data stored on a server at a Microsoft center in Ireland continues to wind its way through the U.S. legal system, with the Supreme Court the likely ultimate arbiter.

At issue: The personal emails of an individual suspected by U.S. authorities in a narcotics case. 

DOJ contends that emails should be treated as the business records of the company hosting them and that a search warrant should compel access to them no matter where they are stored.  

Microsoft argues that the emails are the customers’ personal documents and a U.S. warrant does not carry the authority needed in Ireland - or any foreign jurisdiction - to compel the company to surrender the data.

The Irish government, for its part, maintains that data should only be disclosed on request to the Irish government pursuant to the long standing mutual legal assistance treaty between the U.S. and Ireland.

The case would seem to be a pretty clear no-win all around:

If Microsoft prevails, the global trend towards data localization requirements will almost certainly be accelerated, at the very least undermining the efficiencies of the Cloud, at the very worst Balkanizing the Internet altogether – neither outcome being in anyone’s best interests.

If DOJ carries the day, what little trust may linger in U.S. information service providers will vanish, severely impacting their overseas business prospects and, at the same time, hindering U.S. authorities engaged in legitimate surveillance and data gathering, all the while further setting the precedent for governments worldwide to demand access to data stored in the U.S.

But it’s worse than that.

However the case may ultimately be resolved, uncertainty will reign, piled on top of the chaos echoing in the wake of today’s ECJ Safe Harbor decision, which has left thousands of companies scrambling to sustain businesses and striving for “compliance” with any number of regimes.

Worse yet, governments will not pause their surveillance and data collection.  Indeed, two years of Snowden Revelations might suggest (to some) that the U.S. never really gave a fig about privacy anyway (other governments have yet to be as effectively outed, but are equally suspect).

In that context, whichever way the Microsoft case goes, the U.S. authorities who brought the case will be yet more hindered in the future in terms of “legal” access to the information they desire.  So, they will do what they have already been doing: They will access the data they want in whatever manner they deem necessary.

Meanwhile, in the law enforcement realm, such illicit gathering of information may lead to the institutionalization of the process of “parallel construction,” a method by which the U.S. “exclusionary rule” which protects those accused can be circumvented to allow illegally gathered evidence to be admissible in court, severely undermining the rule of law.

(Parallel construction is already – reportedly - a popular DEA strategy: link)

At the same time, business and criminal enterprises alike may find themselves considering “Pirate Radio”-like data center services, with server banks housed “offshore” (literally or figuratively) in terms of being subject to no-one’s law enforcement or other jurisdiction, potentially threatening the rule of law (but also possibly fostering unique new business opportunities).

Clearly, while concerns related to the confluent conundrums of the Microsoft case and the Safe Harbor collapse are beyond multi-fold, the complexity of the matters involved dictate that there will also be no easy solutions.

So, what next?

Fitful and frustrating global conversations about very complex concepts - ranging from the definition of jurisdiction in a transnational world, to the harmonization of data protection and data compulsion policies, to balancing personal privacy and national security, and beyond.

The goal?

De-conflicting inconsistent data-related (and other) laws and rules across the globe to allow for fair and open and trusted market access to facilitate continued global growth and prosperity in what is an increasingly-digital and borderless world.

How hard can that be?

Cyber-curing what ails us will demand global remedies

Earlier this week (January 13, 2015), President Obama unveiled a slew of proposed cybersecurity-related initiatives, ranging from updated cyber-information sharing legislation to empowering and re-tooling law enforcement to battle cyber-crime; from new data breach reporting requirements to a February 2015 White House Summit on protecting consumers online.

These are all laudable initiatives, indeed, necessary initiatives (although, in light of countless Snowden-unveiled tidbits over the last couple of years, I have my worries about overly-broadly better-empowering law enforcement which, in cahoots with U.S. intelligence agencies, seems to have demonstrated a frighteningly consistent pattern of abuse of such power).

But, to some extent, these proposed initiatives all miss the broader and more critical point: Cyberspace is global, borderless. And, so too, is cyber-malice.  Thus, until and unless the Administration devotes similar – indeed, more forceful - attention to identifying and agreeing globally-applicable disciplines, domestic remedies such as proposed may be challenged to succeed, at least in the grand cyber-scale of things.

Yes, the proposed information sharing legislation would enable the public and private sector to better exchange information about and better analyze, understand and effectively address cyber threats, as well as better safeguard Americans’ personal privacy through the institution of stricter requirements for private companies that collect or use personal data.

Yes, modernizing the legal ecosystem to allow for the prosecution of the sale of things like spyware used to stalk or commit ID theft, as well as the criminalization of the overseas sale of stolen U.S credit card and bank account numbers, and the granting of authority to courts to shut down botnets engaged in DDOS attacks and other criminal activity, are all good and necessary things.

Yes, simplifying and standardizing existing State laws that require businesses to notify consumers of data breaches and corralling them into one Federal statute should indeed serve to both better incent businesses to upgrade their cybersecurity and, thus, better stem the tide of identity theft, financial compromise, etc. 

And, yes, the proposed February 13 “White House Summit on Cybersecurity and Consumer Protection” at Stanford - which will include Administration leaders, CEOs from a range of industries, law enforcement representatives, consumer advocates and technical experts – cannot help but contribute constructively to better educating and protecting American consumers and companies.

These initiatives all seem to acknowledge the need to restore consumer and corporate trust in the networks that power our digital lives and livelihoods, as well as the integrity of the data that funnels through or resides in such networks.  This is a good thing (notwithstanding that the initiatives seem to utterly ignore widespread concerns related to U.S. Government domestic surveillance, espionage, etc.).

While a “fortress America” approach to cybersecurity might be a welcome panacea for the masses, it is insufficient to deal with more global and more potentially devastating cyber-threats, whether Government-spawned malware like Stuxnet, massive-scale DDOS attacks, the theft of billions in intellectual property, or, the big fear, the disruption or destruction of critical infrastructure.

Pre-Snowden, the Administration was quite bullish on setting and enforcing global cyber norms and standards.  As Snowden’s Revelations have wreaked havoc on America’s cyber credibility, the U.S. seems to have hunkered down, shying away from the lead on global solutions, and, by virtue of that seeming withdrawal, to some extent actually perpetuating global insecurities and vulnerabilities.

This week’s White House announcements were heartening, and, hopefully, will lead to an improved State of the cyber-Union, as well as some level of restored confidence in the integrity of networks and data.  However, these initiatives are but domestic pieces of a much bigger global puzzle, the completion of which should remain of the highest priority to U.S. authorities if the domestic initiatives are to be truly meaningful in the long-term.

Surveillance Competition, Take Two...

Two days ago, I blogged on the recent revelation that U.S. intelligence agencies have been intercepting American-made routers and servers and inserting backdoors so that they can penetrate networks in markets in which the gear is deployed (link to my May 13 post).

Since then, the story has continued, including with ars technica running photos yesterday of busy beaver agents “upgrading" Cisco routers at a “secret location” (link).  No shit.

In the post I made a couple of days ago, borrowing from Glenn Greenwald’s Monday unveiling of the NSA’s export interception hijinks (link), I tied the new revelation to the politico-protectionist market access barriers that my employer Huawei Technologies has experienced in the U.S.

Following, is my nutshell synopsis of what’s been going on and why the U.S. Government has been blockading Huawei at home, and attempting to blackball the company abroad (Australia, South Korea, etc.):

Over the last few years, Huawei has grown to become either the leading or number two telecommunications infrastructure provider globally, with Huawei routers and servers and other gear becoming commonplace across the planet.

This turn of events has made the NSA’s eavesdropping practices ever-so-slightly more challenging.  It is far easier to re-route U.S. exports through “secret locations” for beacon-implants than to similarly compromise Huawei gear shipping from elsewhere to elsewhere.

Nevertheless, the NSA has attempted to maintain its overwhelming surveillance footprint through its Shotgiant program which, among other things, stole Huawei proprietary product info with the intent to compromise Huawei gear where deployed (link to my March 25 post on the topic), but it would seem this is a far less efficient model than surreptitious interception and “upgrade” of outbound U.S. exports.

What do to, what to do?

Impede Huawei’s global business. Stymie and attempt to roll back Huawei’s worldwide share so that the NSA's eavesdropping activities could be most easily and broadly managed.

How?

Demonize the company, starting with the U.S. market blockade, then extending to arm-twisting in foreign markets.  The blockade was key.  If Huawei had been allowed an even marginally-significant footprint in the U.S., it would have both furthered the company’s global success and market share, and undermined U.S. Government smear and blackball campaigns in other markets.

I’m not sure this policy is working.

The U.S. strong-arm tactics had some success in Australia, in terms of Huawei not being considered for the government-sponsored national broadband network (NBN) project, but they haven't prevented Huawei from successfully serving Australian commercial network operators.  And, more recent U.S. Government attempts to undermine competition and choice in South Korea seem to have fallen flat altogether.

Worse yet, this week’s revelations from Greenwald may well have yet further adverse impact on the overseas prospects for networking gear from U.S. suppliers, yet further hampering the NSA’s ability to conduct surveillance (not to mention wreaking some potentially not-insignificant commercial havoc for the victimized companies).

Look, I’m not saying that the U.S. government should not be engaged in espionage and intelligence-gathering that is critical to maintaining our national security (although I would observe that the domestic overreach that the Snowden Revelations have detailed over the last 11 months is truly reprehensible).

But the policy and practices have failed, both in terms of the exposure of the NSA’s compromise of U.S. Internet and telecommunications service providers and, as recently learned, ICT gear-makers as well, but also in terms of demonizing a world-respected ICT leader like Huawei (and in so doing also depriving American service providers and consumers of innovative and competitive broadband equipment alternatives).

It’s time for a reset.  Across the board.

While we’ve not likely heard the last from Snowden, et al, the crisis of confidence in the ICT industry is reaching a fever pitch. At stake is a global and interdependent economy that increasingly relies on digital and virtual tools and processes.

It’s time for industry and governments to come together to restore confidence in network and data integrity and security – in the Internet itself – and to do so in a rational, pragmatic, and non-political fashion.   See any number of my posts over the last year for thoughts on how this might happen.

Surveillance Competition (Greenwald Coins a Phrase)

Yesterday, coinciding with the release of his new book No Place to Hide, one-time The Guardian columnist Glenn Greenwald ran a swan song piece in his former employer’s publication titled “how the NSA tampers with US-made internet routers,” heralding the far broader content featured in his book.

In keeping with the trend of recent Snowden Revelations (e.g. drifting away from highlighting ongoing U.S. intelligence agency abuses against American citizens), Greenwald’s piece focused on exposing the NSA’s practice of covertly implanting interception tools in U.S. information and communications technology (ICT) equipment heading overseas.

Surprise.

Not.

The initial Snowden Revelations focused on U.S. intelligence agency compromise of unwilling but sadly witting American internet service and telecommunications providers.  It was really only a matter of time until we were to learn that they went after gear-makers and hardware as well. 

We got a sneak peek at this type of activity in March when Der Spiegel and The New York Times reported on the NSA’s Shotgiant program.  Shotgiant not only penetrated the corporate networks of global ICT industry leader Huawei in order to monitor its confidential communications, but also to steal proprietary product information with the intent to use such information to compromise networks into which the Huawei gear would be deployed.  Link to my blog post on Shotgiant.

(Aside: Lest anyone forget, I work for Huawei)

What Greenwald unveiled yesterday was that not only had American service providers been compromised, but, so too had the ICT hardware and related product of American-based companies. 

Per Greenwald, as per NSA documentation leaked by Snowden: “The NSA routinely receives – or intercepts – routers, servers and other computer network devices being exported from the US before they are delivered to the international customers.  The agency then implants backdoor surveillance tools, repackages the devices with a factory seal and sends them on. The NSA thus gains access to entire networks and all their users.”

Interestingly, Greenwald reports on the NSA’s shenanigans in the context of highlighting that what the NSA has been doing is exactly what U.S. Government entities have consistently yet groundlessly scare-mongered might be done through Huawei equipment.

In the wake of Greenwald’s article, media reports, social media and other conversations feature some surmising that U.S. intelligence agencies were looking in the mirror, observing their own actions, and presuming that the Chinese Government was doing the same thing with China-based companies.  Hence the blockade of Huawei, always accused of but never proven to be potentially complicit. 

But wait.  That assumption doesn’t make sense. 

Greenwald’s account, and subsequent reporting (e.g. see Wall Street Journal article), seem to indicate that the U.S. vendors whose product was violated were not in fact involved with or aware of the violation, rather, that the NSA was covertly snagging outbound exports and then infecting them with whatnot to enable whatever before sending them off on their merry way.

Who knows, we may one day come to learn that the U.S. vendors were indeed complicit, but I very highly doubt it.  It is extremely difficult to imagine the vast conspiracy that such complicity would entail. 

Consider: It was one thing for the NSA to compromise unwilling (for the most part, I believe) service providers - via tidy, manageable conspiracies of the C-suite and legal office - to enable the massive siphoning of data.  It's another thing altogether to compromise tens or hundreds of thousands of routers and servers.  That conspiracy, which would require the complicity of countless employees across a vendor’s organization, would be neither manageable nor sustainable.

The surreptitious interception and infection of outbound product “at the border” which Greenwald and subsequent reporters describe would seem a much better way to get backdoors installed, and would certainly be a lot less prone to information leaks and opposition that would arise in terms of working with complicit vendors.

Which brings us back to the U.S. Government’s opposition to allowing Huawei to compete in the U.S. 

If I am correct that the U.S. vendors were not knowingly compromised, and for the reasons I’ve laid out, then I think it’s pretty fair to assume that the U.S. Government knew full well that Huawei being wittingly compromised by the Chinese Government was also highly unlikely and certainly unsustainable.  Just as was the case with the unwittingly compromised American ICT exporters, it would require a conspiracy far too vast across a very global and very diverse employee population.

So why the Huawei blockade? 

Well, as some have already mused in the wake of Greenwald’s piece yesterday, perhaps because compromising Huawei gear being shipped to far-flung markets would have been a much more challenging endeavor than intercepting and infecting American-made gear.

Greenwald said it better:

 “Warning the world about Chinese surveillance could have been one of the motives behind the US government's claims that Chinese devices cannot be trusted. But an equally important motive seems to have been preventing Chinese devices from supplanting American-made ones, which would have limited the NSA's own reach. In other words, Chinese routers and servers represent not only economic competition but also surveillance competition.”

Later…

Hypocrisy Knows No Heights: Shotgiant

Over the last couple of days, I’ve had no shortage of folk wondering when I might post on Shotgiant.

Frankly, I’ve been flummoxed.  What to say?

According to the New York Times and Der Spiegel, relying on Snowden-released documents, the U.S. National Security Agency (NSA) has, since 2007, been rooting around in Huawei’s corporate networks, monitoring executive communications and stealing proprietary product info.

In terms of the former, the U.S. Government is supposedly meant to be seeking to determine once-and-for-all if Huawei is somehow in cahoots with the PRC Government.

In terms of the latter, they reportedly wanted to be able to exploit Huawei network gear deployed in markets where, it seems, there isn’t a critical mass of already-compromised American gear to gather signals intelligence.

Obviously they haven’t realized their fantasy in terms of objective number one.  If they had, they’d have spread the word and shut the company down.  There is no way they’d have stomached Huawei gear deployed across every other NATO market otherwise.

In terms of objective number two, well, the challenge is now Huawei’s to determine whether and to what extent there’s any truth to what’s detailed in the Snowden leak and how to remedy it.

I swear, I am growing terribly weary of this shit.

So far, the response from the U.S. Government has been limited and muted, something to the effect of “well, when we conduct industrial espionage, we don’t share the information with American companies to give them a commercial edge, like others do.”

Really?

You get your hand caught in the cookie jar and you say “Well yeah, but I didn’t give any cookies to the kids (although they may have stumbled upon some “inadvertently” dropped crumbs), I just re-baked them into concrete and used them to break the neighbor’s windows so I could ransack their house.”

That’s crap. 

If a non-U.S. Government penetrated an American company and monitored their private comms and stole their intellectual property to re-purpose it to exploit networks in the U.S. and other countries we would be up in arms.

And, no, it’s not okay ‘cause we’re ’mericans.  After all, as you sow…  Honestly, we should be setting the right examples, not just examples.

As for the monitoring of Huawei’s communications to “prove” the company is compromised by the Chi-coms, well, they’ve obviously found squat.

Indeed, a wiser man than I made an interesting observation on this element of Shotgiant today.  He had an idea that no-one could possibly have had in advance of the Shotgiant revelation.

Referring to the inexplicably shallow and vacant 2012 U.S. House “Intelligence” Committee Report on Huawei, this wise man wondered if perhaps the entire charade was an intelligence operation.  Think about it. The NSA was five years into mucking about in Huawei’s email servers and hadn't turned up a whit of evidence of any unusual relationship with the Chinese Government.  What to do, what to do?...

Well, why not harness HPSCI and play a game of “shake the tree” - stir up Huawei with an “investigation” and monitor the internal communications to see if that might expose the heretofore unfulfilled pre-ordained outcome of inappropriate government ties?

Judging from the vacuous Intelligence Committee report that emerged nine month’s after the “investigation’s” launch, this didn’t work out either.

Enough already.

I take back the title. 

Hypocrisy should indeed know heights.

America’s Cyber-Contortionist (and Free Trade Champion? – Not)

Just a few days ago, cyber-security specialists and senior government representatives met in Germany at the 50^th annual Munich Security Conference.  

Since 1963, the MSC has served as “an independent forum dedicated to promoting peaceful conflict resolution and international cooperation and dialogue in dealing with today’s and future security challenges.” (More at: https://www.securityconference.de/en/).

Needless to say, in recent years, the MSC has focused on security challenges in the realm of cyber.  This year’s sessions were no different.  One session in particular stood out for me: The January 31 Panel Discussion focused on: "Rebooting Trust? Freedom vs. Security in Cyberspace."

The President of Estonia made an opening statement, and then the CEO of Deutsche Telekom introduced the panelists, including the German Minister of the Interior, the EU Commissioner for Home Affairs, Microsoft’s VP of Security, Huawei’s Chief Security Officer (reminder: Huawei is my employer), and the Chairman of the U.S. House of Representatives Permanent Select Committee on Intelligence (HPSCI), Mike Rogers. 

The panel was moderated by the President of the EastWest Institute, an organization founded in 1980 which “seeks to make the world a safer place by addressing the seemingly intractable problems that threaten regional and global stability.” (More on EWI at http://www.ewi.info/).

Generally speaking, the panelists (almost all) acknowledged the shattered trust in the information communication technology industry (and select governments) in the wake of the Snowden revelations.  Likewise, the panelists (most) detailed possible steps towards restoring confidence.

One panelist, however, stuck out like a sore thumb (one cannot imagine the countless phrases I considered and rejected for that analogy): Chairman Mike.

Go figure.

Mike opened with an acknowledgment that there is “a trust issue,” but pondered aloud about why the group was really gathered: “Damaging classified information that was leaked?  Maybe so.”  But, Mike thinks not.  Indeed, Mike commented that he was “a little surprised” that people were talking about “the problems with the NSA.” 

The Chairman then transitioned into scare-mongering about Iran, North Korea, Russia, China, etc., oozed into an explanation that reports of U.S. spying on French phone calls were misrepresented, and, subsequently, segued to his key mis-direction of the day:  

“The most recent release of information…the United States engages in economic espionage…I have been on the oversight committee doing oversight for our 16 intelligence agencies…for the last ten years…It is against the law in the United States to use our intelligence services for industrial espionage…If they do it, they are going to jail. Period. End of story.” 

Now that’s only part one of the mis-direction, but let’s take a brief time-out to consider it.

Last September I posted on Mike’s utter failure to conduct the oversight with which he is charged (link), so I won’t belabor that point.  But, since he has raised laws and jail, let’s hold him to it: If future revelations show that such industrial espionage did take place, then Mike, by virtue of his position, is aware of and as such complicit to such “illegal” activity and he should be summarily incarcerated…

…But let’s get back to the Chairman’s key mis-direction, part two:

Per Mike: “Now wouldn’t you find it interesting that that information was released at a time when we’re trying to arrange a trade arrangement that I think benefits both Europe and the United States…  I do…”

This little nugget doesn’t get fully matured until the Q&A session, but, the gist: The Russians are managing Snowden in order to time his revelations to tank U.S.-EU Free Trade talks.

In the Q&A session, Mike hammers it home: “I think it’s a huge mistake to allow this issue…to step in the way of a trade agreement between Europe and the United States.  These are two very separate issues…but by tying them together I will guarantee you that you will see more disclosures like we saw last week that the Americans engage in economic espionage…” 

He went on: “You’re gonna see more of that because it breeds distrust – the Russians have a specific purpose for driving a wedge between us and our European allies.”

The Chairman is wrong.  

Not in terms of our seeing further revelations, but in terms of his interpretation of the “tie” between European privacy concerns and the U.S.-EU Free Trade talks.

Europeans have every right to consider privacy protections in the context of U.S.-EU Free Trade negotiations – the former might (albeit unlikely) serve as leverage towards achieving some sort of protections in the context of agreeing the latter, although not likely in the actual substance of any trade agreement.  That is a legitimate tie.  Mike’s suggestion that the Russians are somehow orchestrating the tie borders on absurd.

It gets worse.  Following his initial suggestion that the Russians are orchestrating revelations, and in advance of his Q&A session elaboration on this point, Mike goes on to propel himself headlong into a trap he has set for himself more than once in recent months: 

In defending the integrity and due process of U.S. espionage activities, the Chairman refers to “an oversight mechanism that is not seen anywhere else in the world.  Our judicial branch, our…legislative branch, and our executive branch have to go through an approval process for these activities… that is an important distinction and we argue that is our transparency.”

Sigh. 

Really?  That reference, and the Chairman’s subsequent Q&A session reference to the FISA court and 4^th Amendment protections, are both to processes that only apply to American citizens, and, seemingly, only within U.S. borders, and, from what we have had revealed to us by Mr. Snowden, perhaps not at all. 

One thing is certain though: Europeans and other non-Americans do not benefit from any such oversight or Constitutional prophylaxis (as was pointed out by one clued-in questioner).

C’mon Mike. C’mon America.  Is this the best we have, is this the best we can do?  

(Link to video of the full 1.5 hour panel discussion)

Huawei, the NSA, HPSCI and Lies

Today, Germany's Der Spiegel reported on the latest wave of NSA Revelations (the provenance of which are unclear, but presumably they are Snowden-sourced).

According to the Der Spiegel article (link to GigaOm coverage in English), the most recently unveiled information indicates that the U.S. National Security Agency (NSA) was not only successful at compromising sometimes-witting-but-almost-certainly-unwilling American telecom and Internet service providers, but also at compromising American and non-American telecom and Internet infrastructure hardware and solution providers, without their knowledge.

Through what appears a combination of software hacking and cracking (and, possibly - from my personal perspective - infiltration and tampering with American components, chip-sets, etc. that feed into multinational company supply chains), the NSA has seemingly extended its global surveillance and information dragnet well beyond what had been previously reported, or even imagined.

One of the companies whose gear was reportedly compromised is my employer Huawei.  The irony of this situation could not be richer (Reminder: this is a personal blog reflecting my personal thoughts).

For the last few years, China-headquartered Huawei has been the victim of a U.S. Government-wide (and beyond) conspiratorial witch-hunt.  Vicious and baseless allegations have been made without end, with Huawei accused of being somehow financed, directed, controlled or otherwise uniquely vulnerable to Chinese Government cyber penetration and manipulation.  Wilder and weirder myth and misinformation has been spread, slandering the company and its employees in many and nasty ways.

Never, not once - not once - has there been a shred of substantive evidence presented to support any such allegations.

Now, while to the best of my knowledge Huawei has yet to validate or invalidate the vague suggestions made by Der Spiegel, let's for the moment imagine there is some truth to what's been unveiled.

In that context, let's consider last year's U.S. House of Representatives Permanent Select Committee on Intelligence (HPSCI) "investigation" of Huawei which concluded with the company branded - with zero substantive reason - as some sort of threat to U.S. national security due to being somehow uniquely vulnerable to potential compromise by the Chinese Government.

As much of a circus-like sham as the whole exercise was, it is all the more shameful in light of today's revelations.

Indeed, HPSCI Chairman Rogers - the man charged with overseeing U.S. intelligence activities to prevent abuse, who has instead spent the last six months trying to sugar-coat such abuse - has forever redefined the height of hypocrisy by accusing Huawei of being uniquely vulnerable to compromise by one Government when, as the Chairman of HPSCI, he was almost certainly aware, the U.S. Government had already achieved this feat (at least per Der Spiegel).

You know, in the immediate wake of the initial Snowden Revelations, some joked that the reason the U.S. Government was so hell-bent on keeping Huawei out of the market was because they were uncertain they could penetrate and compromise our solutions as easily as they might the gear of our American or other Western peers.

If Der Spiegel has it right, such lighthearted wit was dead wrong.

Indeed, if Der Spiegel has it right, the whole Huawei embargo and witch-hunt was nothing more than good-old-fashioned protectionism and China-baiting - the NSA has proven that it doesn't matter where a company is headquartered in terms of it's vulnerability to potential malicious penetration and compromise.

These most recent NSA revelations expose past U.S. Government representations about Huawei (and similar opinions from sycophants like my favorite CSIS cyber-gasbag, as well as military-industrial-complex fan-boy groups like the U.S.-China Economic and Security Review Commission) as utterly baseless and equally and maliciously and knowingly duplicitous

Moreover, if Der Spiegel has it right, they have confirmed rather solidly that cyber vulnerabilities are universal, agnostic to geographies, location of headquarters, flags or borders, and demanding of universal industry-wide solutions to address such challenges.

Huawei-related fuming aside, back home, it's time for some serious accountability...

From the Administration.  From the Congress.

U.S. intelligence agencies are now recognized - unequivocally - as the most advanced persistent threat to the integrity of global networks and data.

American standing on the world stage is lessened.

Our ability to project the values we have nourished and cherished for two-plus centuries is diminished.

We are increasingly distrusted abroad.  Such distrust extends to our businesses, and will quite likely yet further adversely impact our economy.

Where will the buck stop?

Shame on you Associated Press, and you too Rep. Wolf

Just shy of 30 years ago, while a student at Georgetown, a roommate of mine had a professor who's kid played in a local recreational soccer league. His team was in need of coaches.  My friend and I, having both played soccer in high school, volunteered.  Good fun.

About a decade later, in the mid-90’s, when I was a mid-level Foreign Service Officer at the State Department in Washington, I re-encountered the professor, who was consulting in State’s Strategy and Planning Office.

Fast forward to 2010, when I was surprised to learn, after joining Huawei, that the professor – still at Georgetown – was a member of Huawei’s newly-minted International Advisory Committee, comprised of illustrious business, academic and other counselors. 

It is, indeed, a very small world.

Today, the Associated Press, in seeming-cahoots with Virginia Congressman Frank Wolf, did a hatchet job on Professor Moran.

In September of this year, after Congressman Wolf (R-VA) “discovered” that the professor was serving simultaneously on both Huawei’s International Advisory Committee and the U.S. Government National Intelligence Council (a group of private sector analysts and policy experts who advise the Office of the Director of National Intelligence on various matters, including foreign investment in the United States), he put pressure on the Director of National Intelligence and the professor was seemingly compelled to resign.

“Discovered?”  Hardly a feat, given that both advisory positions were prominently listed on the professor’s publicaly-available CV, and referenced in his various publications.

Nevertheless, Wolf is one known to give an Administration headaches, so the Administration, fully aware of the professor’s historical situation, bent over and forced the resignation. 

Now, Wolf himself has some justified concerns with China, but he also has an unfortunate and slightly-mad penchant for using Huawei, an independent $35 billion globally-trusted and proven China-headquartered multinational, as his proxy for China-bashing.  (Indeed, I would encourage you to pause in your reading this post and peruse my April 2012 post featuring one of Rep Wolf’s more lunatic tilts at the Huawei windmill before continuing).

Which brings us back to today’s Associated Press piece titled Chinese Firm Paid US Gov't Intelligence Adviser – a lurid and grossly-misleading headline.

Go on.  Read it.  You’ll see.  Headline and remarkably-intentional journalistic bias aside, the story is not news.   Huawei, like many companies, particularly multinational companies, has an international advisory committee.  And advisors are compensated.  Whoopee.  Go figure. 

But, uh oh, shudder, the professor also serves on a U.S. Government advisory committee.  So, shamelessly carrying Wolf’s dirty water, the AP blithely weaves conspiracy from whole cloth, intentionally misleading readers. 

Perhaps the most obvious example of shameless reporting: “In a policy paper distributed by Huawei, Moran wrote in May that, ‘targeting one or two companies on the basis of their national origins does nothing for U.S. security in a world of global supply chains.’ Moran criticized what he described as ‘a policy of discrimination and distortion that discourages valuable inward investment from overseas, while providing a precedent for highly damaging copycat practices in other countries.’”

Let’s parse this out.

First off, the policy paper being referenced by the AP is intentionally misrepresented by the AP as somehow being a Huawei or Huawei-commissioned product.  It is not.  In fact, it is a paper published by the Petersen Institute of International Economics, a world-respected economics and trade think tank where Professor Moran serves as a Fellow. 

Intentionally misrepresented?  Yes.  When the AP was asked to appropriately label the report, they declined, at the editorial level.

Now, let’s consider Professor Moran’s quotes from the policy paper:

“Targeting one or two companies on the basis of their national origins does nothing for U.S. security in a world of global supply chains.”

Spot.  On.   See below.

“A policy of discrimination and distortion that discourages valuable inward investment from overseas, while providing a precedent for highly damaging copycat practices in other countries.” 

Yes.  Exactly.   

Why on earth would the AP suggest such statements were somehow suspect?  It boggles the mind.  All the more so in the wake of the Snowden revelations that, by all indications, seem to be leading to a situation in which U.S.-based companies will suffer similar discrimination in foreign markets.

Shame on you AP for pandering to shallow, baseless, discriminatory politicians and policy.  Shame on you Rep. Wolf for driving this bullshit.   And shame on those in the U.S. Administration that continue to demonize Huawei by virtue of its heritage in China.

Again (borrowing from my post two days ago):

The Information Communications Technology (ICT) industry is transnational, essentially borderless. Whether you are Huawei, Cisco, Alcatel-Lucent or Ericsson you are operating world-wide, equally vulnerable to penetration or compromise, whether by the now-world-renowned experts at the NSA, or whoever their counterparts may be in China, Russia or Israel.   Knocking Huawei out of the market – any market – does precisely squat to secure networks and data.   And the U.S. Government knows all of this.

But (you might ask), hold on, wait a second, if the NSA compromised U.S. companies, then certainly the Chinese Government can compromise Huawei?

That analogy holds no water.  Let’s review:

The penetrations and compromises thus far unveiled by Edward Snowden were primarily achieved by U.S. intelligence agencies either compromising unwitting innocent companies or forcing unwilling (also innocent) companies into unfortunate complicity. 

In terms of the latter, from what we have learned to date, the bulk of the data syphoned off by the NSA, et al was primarily extracted from service operators or data managers under “legal” pretense.  Knowledge of such witting but unwilling compromise of these companies was almost certainly limited to a small few within the companies, perhaps just C-level and legal.

Huawei is a different kind of company. 

Think of the companies referenced above as water companies. 

Think of Huawei as a company that builds the pipes for the plumbing systems used by the water companies. 

The U.S. intelligence agencies went to the legal departments at the water companies and forced a spigot into their reservoirs, virtually draining them.  Again, it is quite likely that very few people within the water companies were even aware of the quiet conspiracy.

Contrast that with a company like Huawei. 

A quiet conspiratorial visit to the legal department or C-level arm-twisting won't do the job.

In order to compromise Huawei’s gear, you would have to infect each and every pipe (router, switch, etc.) which, given the volume of product we produce and the thousands of researchers, coders and builders involved – all around the world - would require an absurdly unbelievable and unsustainable conspiracy of countless employees spanning far-flung countries where research, coding and assembly take place.

But (you might ask), what about after-market “software upgrades” or “patches” or some other digital or magical manipulation of the gear after it’s been sold and deployed?

These are legitimate concerns.

But Huawei is not some *insert government name here*-directed operation in some non-descript building in Shanghai or Silicon Valley.  Huawei is a $35 billion company operating in 150 markets doing 70% of its business outside China, with state-of-the-art Research and Development and software facilities scattered across the globe.

Huawei “software updates” don’t just get “pumped out” willy-nilly.   They are deployed in close coordination with network operator customers and according to the security procedures defined by those customers.

Moreover, within Huawei, every line of code – wherever developed - is tracked and traced by “many eyes and many hands” (human and virtual) which, again, would mean that for Huawei to wittingly “pump out” “back doors” or “exploits” would again require a conspiracy of thousands of our employees, not to mention the additional complicity of employees of our network operator customers.

Absurd.

Could a rogue employee or group of employees plot cyber-shenanigans within the company? Yes.  This could happen at any ICT company - we are all vulnerable.  Yet, like any other world-leading ICT company with a reputation and business to protect, Huawei has employed robust disciplines to detect and quash such anomalies.

But a grand conspiracy?  Hogwash.

And the U.S. Government knows this.  And so should Rep. Wolf. 

And, as for the AP, we might grace them with not having the experience or bandwidth to understand the issues, but they should certainly have more journalistic integrity than to prostitute themselves to politicians…

Huawei, Korea, Pots and Kettles

Yesterday, the U.S. Administration and Senate leadership tag-teamed a stab at undermining the legitimate commercial activities of a China-based multinational in South Korea in order – seemingly (maybe?) – to give the Biden delegation visiting China some sort of additional leverage in bilateral talks, perhaps related to the increasingly-contentious “Air Defense Identification Zone” around the Diaoyu/Sanaku Islands.  

That’s how I see it.  

That, at least, would be a marginally rational explanation.  

The purported explanation defies logic.

Yesterday, the Wall Street Journal and The Daily Beast broke the story of a letter from the Chairs of the Senate Foreign Relations and Select Intelligence Committees calling on the Secretaries of State and Defense, as well as the Director of National Intelligence, to look into “the potential threats and security concerns” presented by Huawei’s involvement in a commercial wireless network deal...in South Korea.   

The Journal reported further that “the Obama administration is privately raising concerns with officials in South Korea about their plans to let a Chinese telecommunications giant develop the country's advanced wireless network, expanding a quiet campaign to warn key allies against integrating the Chinese technology into their systems.”

Okay.  C'mon already.  There should be zero possibility that anyone in the U.S. Government is legitimately concerned about unique network security or data integrity vulnerabilities associated with Huawei gear.  The facts are all too clear to the contrary.  Consider:

The Information Communications Technology (ICT) industry is transnational, essentially borderless. Whether you are Huawei, Cisco, Alcatel-Lucent or Ericsson you are operating world-wide, equally vulnerable to penetration or compromise, whether by the now-world-renowned experts at the NSA, or whoever their counterparts may be in China, Russia or Israel.   Knocking Huawei out of the market – any market – does precisely squat to secure networks and data.   And the U.S. Government knows all of this.

But (you might ask), hold on, wait a second, if the NSA compromised U.S. companies, then certainly the Chinese Government can compromise Huawei? 

That analogy holds no water.  Let’s review:

The penetrations and compromises thus far unveiled by Edward Snowden were primarily achieved by U.S. intelligence agencies either compromising unwitting innocent companies or forcing unwilling (also innocent) companies into unfortunate complicity.  

In terms of the latter, from what we have learned to date, the bulk of the data syphoned off by the NSA, et al was primarily extracted from service operators or data managers under “legal” pretense.  Knowledge of such witting but unwilling compromise of these companies was almost certainly limited to a small few within the companies, perhaps just C-level and legal.

Huawei is a different kind of company.  

Think of the companies referenced above as water companies.  

Think of Huawei as a company that builds the pipes for the plumbing systems used by the water companies.  

The U.S. intelligence agencies went to the legal departments at the water companies and forced a spigot into their reservoirs, virtually draining them.  Again, it is quite likely that very few people within the water companies were even aware of the quiet conspiracy. 

Contrast that with a company like Huawei.  

A quiet conspiratorial visit to the legal department or C-level arm-twisting won't do the job.

In order to compromise Huawei’s gear, you would have to infect each and every pipe (router, switch, etc.) which, given the volume of product we produce and the thousands of researchers, coders and builders involved – all around the world - would require an absurdly unbelievable and unsustainable conspiracy of countless employees spanning far-flung countries where research, coding and assembly take place.

But (you might ask), what about after-market “software upgrades” or “patches” or some other digital or magical manipulation of the gear after it’s been sold and deployed? 

These are legitimate concerns, though sadly, unfortunately, somewhat de-legitimized by the canned quotes from the Center for Strategic and International Studies’ persistently-resident cyber-gasbag that were featured in the Daily Beast article. 

Per The Daily Beast, the aforementioned “expert” said that “Huawei’s routers and switches may be clean at first. But the potential for back doors, or exploits within the software and hardware of the equipment, could be slipped into the gear through routine maintenance such as software updates.”  “They can pump out a software update and you have no idea what is in the software.”

Such hyperbolic paranoia (or perhaps just utter ignorance of the business realities in the ICT industry) borders on mind-numbing.

Huawei is not some <insert government name here>-directed operation in some non-descript building in Shanghai or Silicon Valley.  Huawei is a $35 billion company operating in 150 markets doing 70% of its business outside China, with state-of-the-art R&D and software facilities scattered across the globe. 

Huawei “software updates” don’t just get “pumped out” willy-nilly.  

They are deployed in close coordination with network operator customers and according to the security procedures defined by those customers. 

Moreover, within Huawei, every line of code – wherever developed - is tracked and traced by “many eyes and many hands” (human and virtual) which, again, would mean that for Huawei to wittingly “pump out” “back doors” or “exploits” would again require a conspiracy of thousands of our employees, not to mention the additional complicity of employees of our network operator customers.

Absurd.

Could a rogue employee or group of employees plot cyber-shenanigans within the company? Yes.  This could happen at any ICT company - we are all vulnerable.  Yet, like any other world-leading ICT company with a reputation and business to protect, Huawei has employed robust disciplines to detect and quash such anomalies. 

But a grand conspiracy?  Hogwash.

And the U.S. Government knows this.  

Which brings us back to the quest for a rational explanation for the odd concert of Administration officials and Senate Chairs attempting to interfere in the Korean commercial wireless marketplace.  I posited one such explanation at the outset of this post.  A placeholder of sorts.  Far-fetched?  

Maybe. 

But one thing we do know, it has nothing to do with network security or data integrity.  Indeed, that fig leaf is growing frightfully thin...

The End of (knowing) ICT Company Complicity with Gov’t Spying?

The Snowden revelations may very likely mark the beginning of the end of "knowing" corporate complicity with government espionage.

That’s a powerful statement.  But I think it is an inevitability.

It's funny...I work for Huawei, a $35 billion China-based multinational technology company that has suffered remarkable discrimination and market access barriers in the U.S. due to concerns that Huawei product might somehow be compromised and used for espionage by the Chinese Government.

The concern has always been prospective, given that there has never been any proof of such past or current activity.  

Indeed, until the Snowden revelations, U.S. Government concerns about Huawei were a bit confounding.  I mean, Huawei’s a multi-billion dollar company doing business across the globe, including in every free-market democratic nation allied with the U.S.   Had everyone else been hornswoggled?

Post-Snowden, it's been all too clear what prompted the concerns.  

American companies had been compromised by their government to support espionage, at home and abroad, and, so, the natural assumption was that other governments were similarly penetrating companies headquartered in their countries.   

There very well might be some truth to this, particularly in terms of state-owned companies.

However, contrary to popular (American) belief, not all companies in China are State-owned or controlled.  Indeed, there is an increasing number of China-headquartered companies like Huawei which are private.  A company like Huawei that is doing 70% of its $35 billion in business outside of China would have to be insane to risk that business by knowingly allowing its product to be subverted by any government.

One would think that the same would have been the thought process of U.S.-based technology giants.  We have learned, in the wake of Snowden, saying "no" was seemingly not an option.

Okay, as Americans, facilitating our government’s legitimate need to gather intelligence must be in our best and patriotic interest, no?  Perhaps.  But at what cost?  Our technology leaders, which, wittingly - albeit by most accounts unwillingly - compromised their gear and networks per Government dictate are now suffering in global markets due to their compromise having been exposed.

Ironically, Huawei – notwithstanding unsubstantiated accusations otherwise – has never been asked, directed or otherwise been compromised or wittingly penetrated by any government.

Whatever the case, there is a growing and global crisis of confidence in the information and communications technology (ICT) industry and the security and integrity of networks and data.

China is investigating compromised American companies and the U.S. maintains its political-protectionist blockade of China-based network equipment companies.  Brasil talks of a domestic Internet while India considers banning U.S.-based email service providers and Deutsche Telekom markets “Email made in Germany” as an alternative to penetrated U.S. providers. 

Balkanization, fragmentation, regionalization…call it what you want, but it’s not in anyone’s long-term interest.  The ICT industry has blossomed over the last two decades in large part because of globalized scale and transnational innovative ecosystems and supply chains, digital and physical.  Confidence and trust must be restored before 20 years of progress is undone.

And, lacking a significant course-correction, the impact will be most harsh on U.S.-based companies.  The damage thus far is not unduly severe, but the impact of potential boycotts of perceived-to-be-compromised American companies will almost certainly have an increasing and adverse economic impact in the U.S.  

Sacrificing an industry that the U.S. helped drive to global success is an absurd cost for whatever espionage benefit may have been derived. 

Moreover, "knowing" corporate complicity in government espionage is not sustainable because, as we have all now learned, once the corporations have been outed as compromised, they cease to be a reliable source of information if they are shunned by consumers of their goods or services.

Somehow or other, it worked until Snowden.  It won’t work anymore.

Governments will not stop spying on each other, nor on the peoples and businesses of the world, including within their own borders.  This is a given.  But, industry – and everyday citizens - need to stand up and reject legal or regulatory regimes that compel the private sector to facilitate wholesale government data collection, monitoring, analysis, storage and misuse or outright abuse.  

This will not happen overnight.

While that dialogue takes place, there should be three simultaneous conversations in three separate but interrelated realms.   

Service providers and data managers must take a leadership role in driving the legal and regulatory course-correction referenced above, and in that and a future more protected information environment context, they should be required to divulge to consumers (enterprise or individual) the type of information they might share with Governments and in which appropriate and legal contexts.

In terms of the nuts and bolts and software of network infrastructure, vendors should come together to define independent third-party (including Government) certifiable standards and best practices to better secure products and solutions – hardware, firmware and software - spanning supply chains, and from ideation to end-of-life.

Finally, Governments need to agree among themselves a framework for acceptable behavior in the ether.  Espionage is a given.  But commercial espionage and, of greater concern, disruptive or destructive cyber-activities should be defined, discouraged and punished under mutually-agreed terms and conditions.

Again, none of this will happen overnight.

But, just starting the dialogue - rather than having consumers wallowing in fear and governments and industry vainly denying the obvious – should at least, to some extent, mellow the ongoing crisis of confidence, and, equally important, derail the fragmentation of the global Internet and ICT industry.