Cyber-curing what ails us will demand global remedies

Earlier this week (January 13, 2015), President Obama unveiled a slew of proposed cybersecurity-related initiatives, ranging from updated cyber-information sharing legislation to empowering and re-tooling law enforcement to battle cyber-crime; from new data breach reporting requirements to a February 2015 White House Summit on protecting consumers online.

These are all laudable initiatives, indeed, necessary initiatives (although, in light of countless Snowden-unveiled tidbits over the last couple of years, I have my worries about overly-broadly better-empowering law enforcement which, in cahoots with U.S. intelligence agencies, seems to have demonstrated a frighteningly consistent pattern of abuse of such power).

But, to some extent, these proposed initiatives all miss the broader and more critical point: Cyberspace is global, borderless. And, so too, is cyber-malice.  Thus, until and unless the Administration devotes similar – indeed, more forceful - attention to identifying and agreeing globally-applicable disciplines, domestic remedies such as proposed may be challenged to succeed, at least in the grand cyber-scale of things.

Yes, the proposed information sharing legislation would enable the public and private sector to better exchange information about and better analyze, understand and effectively address cyber threats, as well as better safeguard Americans’ personal privacy through the institution of stricter requirements for private companies that collect or use personal data.

Yes, modernizing the legal ecosystem to allow for the prosecution of the sale of things like spyware used to stalk or commit ID theft, as well as the criminalization of the overseas sale of stolen U.S credit card and bank account numbers, and the granting of authority to courts to shut down botnets engaged in DDOS attacks and other criminal activity, are all good and necessary things.

Yes, simplifying and standardizing existing State laws that require businesses to notify consumers of data breaches and corralling them into one Federal statute should indeed serve to both better incent businesses to upgrade their cybersecurity and, thus, better stem the tide of identity theft, financial compromise, etc. 

And, yes, the proposed February 13 “White House Summit on Cybersecurity and Consumer Protection” at Stanford - which will include Administration leaders, CEOs from a range of industries, law enforcement representatives, consumer advocates and technical experts – cannot help but contribute constructively to better educating and protecting American consumers and companies.

These initiatives all seem to acknowledge the need to restore consumer and corporate trust in the networks that power our digital lives and livelihoods, as well as the integrity of the data that funnels through or resides in such networks.  This is a good thing (notwithstanding that the initiatives seem to utterly ignore widespread concerns related to U.S. Government domestic surveillance, espionage, etc.).

While a “fortress America” approach to cybersecurity might be a welcome panacea for the masses, it is insufficient to deal with more global and more potentially devastating cyber-threats, whether Government-spawned malware like Stuxnet, massive-scale DDOS attacks, the theft of billions in intellectual property, or, the big fear, the disruption or destruction of critical infrastructure.

Pre-Snowden, the Administration was quite bullish on setting and enforcing global cyber norms and standards.  As Snowden’s Revelations have wreaked havoc on America’s cyber credibility, the U.S. seems to have hunkered down, shying away from the lead on global solutions, and, by virtue of that seeming withdrawal, to some extent actually perpetuating global insecurities and vulnerabilities.

This week’s White House announcements were heartening, and, hopefully, will lead to an improved State of the cyber-Union, as well as some level of restored confidence in the integrity of networks and data.  However, these initiatives are but domestic pieces of a much bigger global puzzle, the completion of which should remain of the highest priority to U.S. authorities if the domestic initiatives are to be truly meaningful in the long-term.

Fun With Facts: The Gertz Edition

Two days ago, the online radical conservative publication The Washington Free Beacon featured an article authored by Sino-phobe and habitual Huawei-basher Bill Gertz. 

Titled “Congress Targets Chinese Telecom Threat,” Gertz’s piece vomits up copious amounts of Huawei FUD and slander in its hyper-maniacal applause for a pair of Congressional amendments which, while setting trade-distorting precedents like-as-not to be used against American companies overseas, probably won't achieve much in terms of addressing any legitimate national security concerns.

Let’s parse through this turd of an article:

(And, lest anyone forget, Huawei is my employer, but the words, sentiments and opinions in this blog are mine and mine alone, unvetted by anyone).  

Gertz’s words are in italics, my observations, in bold:

Current House intelligence and defense legislation now before Congress is seeking to block U.S. intelligence officials from working for Chinese-linked companies, and also is aimed at preventing a major Chinese telecommunications firm from conducting cyber attacks against defense and intelligence networks.

“Chinese-linked companies?”  Uh…  In terms of the information and communications technology industry, that’s pretty much everyone.

Two amendments now part of the fiscal 2015 intelligence and defense authorization bills target China’s Huawei Technologies, a company linked by the U.S. government to electronic spying, although the company is not named specifically in the legislation, members of Congress and aides said.

The intelligence bill amendment would prevent former U.S. intelligence officials from joining companies like Huawei, which the U.S. government has linked to China’s military and illicit spying through its network equipment.

Except that is not the case.  First off, the U.S. Government has, in fact, never – never – cited a shred of credible evidence of any unusual link between Huawei and any government, nor has there ever been any allegation of illicit spying through Huawei network equipment or otherwise.  Being gracious, the USG has at most suggested only potential or prospective concerns. 

Indeed, with all of this in mind, and as explained to Gertz in an email exchange in advance of the publication of his article, the “covered entity” definition in the intelligence bill amendment in no way, shape or form applies to Huawei.  No-one – no-one – has ever once – not once – offered a shred of credible or substantive information to suggest otherwise.

The defense bill amendment would require the director of national intelligence and secretary of defense to report to Congress on all bids by foreign telecommunications companies seeking U.S. contracts.

Both measures are being dubbed the Rogers’ amendments after their Republican sponsors: Rep. Mike Rogers of Michigan, chairman of the House Permanent Select Committee on Intelligence; and Rep. Mike Rogers of Alabama, chairman of the House Armed Services subcommittee on strategic forces. “I am greatly concerned Chinese-government-controlled telecommunications companies could pose a direct threat to our national security,” said Rogers of Alabama who sponsored the defense amendment.

“We need to make sure we’re protecting all levels of our infrastructure,” he said. “This is an issue that affects big cities, small towns, and military bases in every corner of the U.S. and those overseas as well.”

These seem like legitimate concerns.  But contrary to Gertz’s or anyone else’s willfully uninformed opinion, Huawei is not “Chinese-government controlled,” so, as pointed out to Gertz via email before his article ran, the amendment has no relevancy to Huawei.

And, as further communicated to Gertz by email, the defense bill amendment is extremely worrisome in terms of its very broad and trade-distorting precedent-setting nature.  In this context, I commented to Gertz: “…One can only hope that a responsible, rational and transparent process will be developed and communicated to explain how a finding of “suspected of being influenced” might be made, and that strict and rational and transparent rules will be developed to define the character and fact-based validity of the substance of the required “Elements of Notification” (section c, 1-3).  Otherwise, the risk of generating copycat techno-nationalist like policy, law or regulations in other markets is great, and to the detriment of U.S. businesses operating overseas.”

Both amendments passed the House last month and now face House-Senate conferences.

Huawei spokesman Bill Plummer declined to comment on the legislation.

Well, I did offer the observations noted above, but Gertz seemed to have little interest in alternative perceptions.   He is correct, however, that I did not offer any official Huawei on-the-record comment – I mean, really, why would any company dignify this nonsense with a response?

Rep. Frank Wolf, (R., Va.) said he supports both measures, and specifically the intelligence employees restriction. Wolf was the first to reveal last year that Huawei had hired Theodore Moran, who worked on two government intelligence advisory panels at the same time he was paid consultant for the Chinese company.

“I think it’s good amendment and it’s a problem I think neither [Republican or Democratic] administration has addressed,” Wolf said in an interview. “When you get a guy connected to some of these groups who comes in and advises an administration on public policy, it’s not a good idea.”

Ah yes, Representative Wolf…  Another unabashed basher with questionable interest in the facts.  But hey, I'll give credit where credit is due: At least this time he didn’t reference George Clooney (for more on this and to put Rep. Wolf’s opinions in perspective, please see my April 29, 2012 blog post). 

Susan Phalen, a spokeswoman for the House intelligence committee, said the amendment is needed to protect secrets. Senior intelligence officials gain access to the nation’s most sensitive secrets during their careers, she said in an email.

“This provision would help avoid conflicts of interest or the appearance of impropriety in post-government employment funded by governments that pose a high counterintelligence threat to the United States,” Phalen said. “These limits are analogous to the restrictions on executive and legislative branch employees who seek to lobby the federal government after they leave public service.”

I’ll leave her alone. She’s just a mouthpiece.

The global Chinese telecommunications equipment maker is widely viewed within the U.S. intelligence and military communities as an arm of the Chinese government that is engaged in clandestine intelligence collection through its equipment.

Nonsense.  There has never – never - been any USG claim that Huawei is “an arm of the Chinese government,” nor that the company is “engaged in clandestine intelligence collection through its equipment.”  As stated earlier, any ill-founded or politically-inspired concerns have virtually always been prospective.

The Pentagon’s annual report on the Chinese military has linked Huawei to Beijing’s People’s Liberation Army (PLA). “Information technology companies in particular, including Huawei, Datang and Zhongxing, maintain close ties to the PLA,” a report several years ago said.

Yawn.  ‘Been reading this bullet since the 2005 Rand Report introduced the fallacy.  There is zero evidence to back it up. Never has been.

The first Rogers amendment is a response to the case of a senior adviser to the Director of National Intelligence (DNI), Theodore Moran, who worked for DNI as an adviser at the same time he was a paid consultant to Huawei.

The provision prevents all U.S. intelligence officials with access to sensitive compartmented information, the most secret classified information category, from working with suspect foreign companies for a period of one year after leaving government. For two years following retirement, covered intelligence officials cannot work for an outside foreign company on any matter relating to their work for spy agencies during the last year of employment.

It also would require former intelligence officials to report to their former agencies any payments received from suspect foreign employers.

Both requirements would be imposed for five years.

Seems reasonable.

The measure also requires the designation of certain governments that that are classified as “a significant counterintelligence threat,” such as China and Russia.

The Obama administration, according to observers, has been lax in pursuing foreign intelligence agents. Since the 2010 arrests of 10 Russian undercover agents, the administration has not apprehended a single significant foreign spy.

The second Rogers amendment calls on the defense secretary and DNI to notify Congress if every foreign-influenced company or its affiliate “is competing for, or has been awarded a contract” that could impact military or intelligence systems.

To the point I made to Gertz in our email exchange, how might “foreign-influenced” be determined?  Based on facts?

The legislation specifies the networks as “information technology or telecommunications networks of the Department of Defense or the intelligence community; and information technology or telecommunications networks of network operators supporting systems in proximity to Department of Defense or intelligence community facilities.”

A U.S. official said the provision is aimed at preventing companies like Huawei from infiltrating rural U.S. and other networks through sales of equipment to local telecommunications firms, as has occurred in the past, in an effort to avoid federal security scrutiny.

“Infiltrating?”  “An effort to avoid federal security scrutiny?”  Good grief. Huawei has been operating openly in the United States since 2001, serving a number of carriers, rural and otherwise, as a result of open and competitive bidding processes. 

“We’ve seen Huawei go under the radar in seeking to infiltrate rural providers,” the official said. “We have to be careful that we don’t wake up in five years and find that 20 percent of the country is using Huawei equipment.”

“Under the radar?”  See above.  Who is this shallow, duplicitous scare-mongering “official” that Gertz is quoting? 

The amendment also was written broadly enough to capture the recent deal between Huawei and South Korea’s LG that has raised concerns about the security of U.S. military communications in a potential war zone.

U.S. intelligence and military officials have said allowing Huawei to build a South Korean network could compromise U.S. military communications in a future conflict on the Korean Peninsula.

Chris Bush, a spokesman for the U.S. Forces Korea, told the Free Beacon last month that the command is concerned about the contract between Huawei and the South Korean company LG as a potential security problem.

“Telecommunications equipment is inherently vulnerable to a multitude of threats, from interception and monitoring to malicious software and applications, regardless of service provider,” Bush said in response to questions about the Huawei-LG deal.

Hey. Wait…

“Telecommunications equipment is inherently vulnerable to a multitude of threats, from interception and monitoring to malicious software and applications, regardless of service provider…” 

Spot on Chris.  I mean, the NSA has certainly proven this point, and, further, has demonstrated that it doesn’t matter which company built the gear, nor where any company may be headquartered.

Rogers of Michigan said earlier this year that he opposes permitting Huawei to set up a telecommunications network in South Korea.

“Allowing Huawei equipment into South Korea’s advanced wireless network could create dangerous operational security vulnerabilities for the U.S. and South Korean military and government personnel who will inevitably use this network,” Rogers said.

"Intelligence" Committee Chairman?  Really?  

Huawei is supplying commercial telecommunications infrastructure equipment built to open and globally-specified technical standards for deployment by a commercial operator in a commercial network in South Korea.   

Really Mike?  Our military and government are sending secure communications over open commercial wireless networks?

The defense amendment would require the DNI to report to Congress annually on whether suspect foreign companies are competing for or were awarded contracts related to information technology or telecommunications components.

“Suspect?”  See comments above about “foreign-influenced.”

The U.S. government has blocked Huawei three times since the early 2000s from buying or merging with U.S. telecommunications firms over spying concerns.

Australia has also blocked Huawei from doing business there and Britain’s government has set up a special security panel to review Huawei equipment used in Britain’s networks.

Dead wrong.  Yes, the Australian government - under strong pressure from the U.S. government – blocked Huawei from a government-sponsored broadband network, but otherwise, Huawei is a major supplier of commercial communications network gear in Australia, and in the UK, where the government has taken a commercially rational approach to legitimate security concerns.

A House Permanent Select Committee on Intelligence report in 2012 identified Huawei and another Chinese telecom firm, ZTE, as security threats that could facilitate electronic spying by the Chinese government. The report concluded that U.S. companies should not use any Chinese gear in networks.

The House report also warned that other infrastructures, including electric power grids; banking and finance systems; natural gas, oil, and water systems; and rail and shipping channels all could be compromised by penetrating computerized control systems.

The HPSCI report is almost universally recognized as vapid, utterly vacant, its findings and recommendations ungrounded by even basic facts.  Look, don’t take my word for it, read it - then you will understand why The Economist labelled it “a report for vegetarians” (no meat).

An open-source U.S. intelligence report from 2011 said Huawei was linked to the Ministry of State Security, the civilian political police and intelligence service, through one of its executives.

The CIA-based Open Source Center report said Huawei’s chairwoman, Sun Yafang, worked for the Ministry of State Security (MSS) Communications Department before joining the company. The report said Sun used her connections at MSS to help Huawei through “financial difficulties” when the company was founded in 1987.

Stuff and utter nonsense, and Gertz knows it.  The Open Source Center report is nothing other than a non-classified regurgitation of articles in the open media, including, in one instance, a mis-informed report in an obscure Chinese online publication that was later retracted, but only after it had been picked up by other media. 

China’s government has paid Huawei more than $220 million for research and development in the past decade.

Yawn.  This is information openly available on Huawei’s website.  Huawei gets commercial R&D grants from governments around the world, as do Huawei’s Western-based peers, including from the Chinese government. Such grants make up a miniscule fraction of Huawei’s annual $5+ billion in R&D investment.

The OSC report, dated Oct. 5, said Huawei’s senior leaders have “connections” to the PLA. Huawei founder Ren Zhengfei worked for China’s military from 1974 to 1983 in the engineering corps.

I can barely bring myself to bother on this one.  “Connections?”  And even Gertz puts it in quotes.  And yes, Huawei’s founder was in the military three decades ago.  Big whoop.

Huawei’s headquarters is located in Shenzen, China, the companies has plans for facilities in 10 U.S. cities.

Gertz fails to get even the most basic facts straight: Huawei has been in the U.S. since 2001 and already has facilities in over 10 U.S. cities.

Surveillance Competition, Take Two...

Two days ago, I blogged on the recent revelation that U.S. intelligence agencies have been intercepting American-made routers and servers and inserting backdoors so that they can penetrate networks in markets in which the gear is deployed (link to my May 13 post).

Since then, the story has continued, including with ars technica running photos yesterday of busy beaver agents “upgrading" Cisco routers at a “secret location” (link).  No shit.

In the post I made a couple of days ago, borrowing from Glenn Greenwald’s Monday unveiling of the NSA’s export interception hijinks (link), I tied the new revelation to the politico-protectionist market access barriers that my employer Huawei Technologies has experienced in the U.S.

Following, is my nutshell synopsis of what’s been going on and why the U.S. Government has been blockading Huawei at home, and attempting to blackball the company abroad (Australia, South Korea, etc.):

Over the last few years, Huawei has grown to become either the leading or number two telecommunications infrastructure provider globally, with Huawei routers and servers and other gear becoming commonplace across the planet.

This turn of events has made the NSA’s eavesdropping practices ever-so-slightly more challenging.  It is far easier to re-route U.S. exports through “secret locations” for beacon-implants than to similarly compromise Huawei gear shipping from elsewhere to elsewhere.

Nevertheless, the NSA has attempted to maintain its overwhelming surveillance footprint through its Shotgiant program which, among other things, stole Huawei proprietary product info with the intent to compromise Huawei gear where deployed (link to my March 25 post on the topic), but it would seem this is a far less efficient model than surreptitious interception and “upgrade” of outbound U.S. exports.

What do to, what to do?

Impede Huawei’s global business. Stymie and attempt to roll back Huawei’s worldwide share so that the NSA's eavesdropping activities could be most easily and broadly managed.

How?

Demonize the company, starting with the U.S. market blockade, then extending to arm-twisting in foreign markets.  The blockade was key.  If Huawei had been allowed an even marginally-significant footprint in the U.S., it would have both furthered the company’s global success and market share, and undermined U.S. Government smear and blackball campaigns in other markets.

I’m not sure this policy is working.

The U.S. strong-arm tactics had some success in Australia, in terms of Huawei not being considered for the government-sponsored national broadband network (NBN) project, but they haven't prevented Huawei from successfully serving Australian commercial network operators.  And, more recent U.S. Government attempts to undermine competition and choice in South Korea seem to have fallen flat altogether.

Worse yet, this week’s revelations from Greenwald may well have yet further adverse impact on the overseas prospects for networking gear from U.S. suppliers, yet further hampering the NSA’s ability to conduct surveillance (not to mention wreaking some potentially not-insignificant commercial havoc for the victimized companies).

Look, I’m not saying that the U.S. government should not be engaged in espionage and intelligence-gathering that is critical to maintaining our national security (although I would observe that the domestic overreach that the Snowden Revelations have detailed over the last 11 months is truly reprehensible).

But the policy and practices have failed, both in terms of the exposure of the NSA’s compromise of U.S. Internet and telecommunications service providers and, as recently learned, ICT gear-makers as well, but also in terms of demonizing a world-respected ICT leader like Huawei (and in so doing also depriving American service providers and consumers of innovative and competitive broadband equipment alternatives).

It’s time for a reset.  Across the board.

While we’ve not likely heard the last from Snowden, et al, the crisis of confidence in the ICT industry is reaching a fever pitch. At stake is a global and interdependent economy that increasingly relies on digital and virtual tools and processes.

It’s time for industry and governments to come together to restore confidence in network and data integrity and security – in the Internet itself – and to do so in a rational, pragmatic, and non-political fashion.   See any number of my posts over the last year for thoughts on how this might happen.

Surveillance Competition (Greenwald Coins a Phrase)

Yesterday, coinciding with the release of his new book No Place to Hide, one-time The Guardian columnist Glenn Greenwald ran a swan song piece in his former employer’s publication titled “how the NSA tampers with US-made internet routers,” heralding the far broader content featured in his book.

In keeping with the trend of recent Snowden Revelations (e.g. drifting away from highlighting ongoing U.S. intelligence agency abuses against American citizens), Greenwald’s piece focused on exposing the NSA’s practice of covertly implanting interception tools in U.S. information and communications technology (ICT) equipment heading overseas.

Surprise.

Not.

The initial Snowden Revelations focused on U.S. intelligence agency compromise of unwilling but sadly witting American internet service and telecommunications providers.  It was really only a matter of time until we were to learn that they went after gear-makers and hardware as well. 

We got a sneak peek at this type of activity in March when Der Spiegel and The New York Times reported on the NSA’s Shotgiant program.  Shotgiant not only penetrated the corporate networks of global ICT industry leader Huawei in order to monitor its confidential communications, but also to steal proprietary product information with the intent to use such information to compromise networks into which the Huawei gear would be deployed.  Link to my blog post on Shotgiant.

(Aside: Lest anyone forget, I work for Huawei)

What Greenwald unveiled yesterday was that not only had American service providers been compromised, but, so too had the ICT hardware and related product of American-based companies. 

Per Greenwald, as per NSA documentation leaked by Snowden: “The NSA routinely receives – or intercepts – routers, servers and other computer network devices being exported from the US before they are delivered to the international customers.  The agency then implants backdoor surveillance tools, repackages the devices with a factory seal and sends them on. The NSA thus gains access to entire networks and all their users.”

Interestingly, Greenwald reports on the NSA’s shenanigans in the context of highlighting that what the NSA has been doing is exactly what U.S. Government entities have consistently yet groundlessly scare-mongered might be done through Huawei equipment.

In the wake of Greenwald’s article, media reports, social media and other conversations feature some surmising that U.S. intelligence agencies were looking in the mirror, observing their own actions, and presuming that the Chinese Government was doing the same thing with China-based companies.  Hence the blockade of Huawei, always accused of but never proven to be potentially complicit. 

But wait.  That assumption doesn’t make sense. 

Greenwald’s account, and subsequent reporting (e.g. see Wall Street Journal article), seem to indicate that the U.S. vendors whose product was violated were not in fact involved with or aware of the violation, rather, that the NSA was covertly snagging outbound exports and then infecting them with whatnot to enable whatever before sending them off on their merry way.

Who knows, we may one day come to learn that the U.S. vendors were indeed complicit, but I very highly doubt it.  It is extremely difficult to imagine the vast conspiracy that such complicity would entail. 

Consider: It was one thing for the NSA to compromise unwilling (for the most part, I believe) service providers - via tidy, manageable conspiracies of the C-suite and legal office - to enable the massive siphoning of data.  It's another thing altogether to compromise tens or hundreds of thousands of routers and servers.  That conspiracy, which would require the complicity of countless employees across a vendor’s organization, would be neither manageable nor sustainable.

The surreptitious interception and infection of outbound product “at the border” which Greenwald and subsequent reporters describe would seem a much better way to get backdoors installed, and would certainly be a lot less prone to information leaks and opposition that would arise in terms of working with complicit vendors.

Which brings us back to the U.S. Government’s opposition to allowing Huawei to compete in the U.S. 

If I am correct that the U.S. vendors were not knowingly compromised, and for the reasons I’ve laid out, then I think it’s pretty fair to assume that the U.S. Government knew full well that Huawei being wittingly compromised by the Chinese Government was also highly unlikely and certainly unsustainable.  Just as was the case with the unwittingly compromised American ICT exporters, it would require a conspiracy far too vast across a very global and very diverse employee population.

So why the Huawei blockade? 

Well, as some have already mused in the wake of Greenwald’s piece yesterday, perhaps because compromising Huawei gear being shipped to far-flung markets would have been a much more challenging endeavor than intercepting and infecting American-made gear.

Greenwald said it better:

 “Warning the world about Chinese surveillance could have been one of the motives behind the US government's claims that Chinese devices cannot be trusted. But an equally important motive seems to have been preventing Chinese devices from supplanting American-made ones, which would have limited the NSA's own reach. In other words, Chinese routers and servers represent not only economic competition but also surveillance competition.”

Later…