Cyber Security: A Fact-Based Primer

While the mainstream dialogue related to “cyber-security” most often focuses on issues related to consumer privacy and identity theft, the more cloistered industry and government debate circulates around espionage and so-called cyber-war. The concerns are legit, but the debate is all-too-often hijacked by political or competitive agendas, undermining progress towards true solutions.

So let’s try and dissect this - what are we talking about when we’re debating non-consumer-oriented cyber security concerns? While there are multiple and competing definitions of cyber security, most would all include at least the following: Network exploitation or attack, including espionage and/or the disruption of networks via software in or for or otherwise through the manufacture of network equipment, including via hardwired backdoors in chipsets, routers or other physical parts of the network.

In terms of potential “cyber weapons,” they might include: Unauthorized access to systems (hacking), viruses, worms, trojans, denial-of-service, distributed denial of service (including using botnets), root-kits and, of course, social engineering. Such tools can be used to compromise confidentiality or otherwise facilitate identity theft, web-defacement, extortion, system hijacking and/or service blockading. Key to note, cyber weapons can be used individually, in combination, and – generally most concerning - blended with conventional kinetic/physical weapons as force multipliers.

Who’s in the game? Pretty much everyone, ranging from the Russians to the Israelis, but the big dogs would be the U.S. and China, both of which have been quite public in communicating their cyber capabilities and intent. Indeed, reported instances of China-based cyber-incursions are significant. A couple of well-publicized examples:

Titan Rain (Government espionage) was a series of coordinated attacks with reported Chinese origin on U.S. Government, defense industrial base and R&D institutions, originally identified in 2003. Among other targets, hackers reportedly gained access to: U.S. Army Information Systems Engineering Command; Defense Information Systems Agency; U.S. Army Space and Strategic Defense Center; NASA; and Sandia Labs.

Night Dragon (industrial espionage), according to a February 2011 report from McAfee, was a coordinated series of cyber attacks which began in November 2009, aimed at global oil, energy, and petrochemical companies to harvest sensitive information on industrial operations in Kazakhstan, Taiwan, Greece, and the U.S. McAfee identified the tools, techniques, and network activities used in these attacks as originating in China.

But China is not alone in terms of being perceived (if not absolutely proven) to be engaged in strategic cyber warfare activities. Other examples, specifically geared to more concerning disruptive activities, include:

Estonia: In April and May of 2007, Estonia experienced a heavy barrage of coordinated cyber attacks against information networks, Government services and news portals. The attacks, which followed a decision to relocate a Soviet-era grave marker, were primarily in the form of distributed denial of services (DDOS), including the remarkably coordinated use of sophisticated botnets. The Russian Government was suspected but has not been proven to be responsible. While there were no long-term consequences from the attacks, short-term impact in terms of unavailability of online services were significant, particularly in a market where 98% of banking transactions take place online.

Georgia: In the weeks leading up to a Russian physical invasion of Georgia in 2008, Georgian communications, Government and financial networks came under significant cyber attack. While the immediate and most public perception of the assault was related to the defacement of Government sites, more impactful was the repeat of a strategic and coordinated DDOS attack which, as a force multiplier, disrupted communications and online activity impairing critical Government and citizen communications before and during the physical attack. While the cyber-attacks are widely believed to have originated in Russia, no Government involvement has been proven.

Iran: Stuxnet, a MS Windows computer worm, was discovered in July and 2010. Designed to target Siemens Supervisory Control and Data Acquisition (SCADA) systems, Stuxnet is the first discovered malware that spies on and subverts industrial systems . It is widely acknowledged that Stuxnet was targeted to disrupt the uranium enrichment infrastructure in Iran, with the U.S. and Israel most regularly referenced as the likely perpetrators, although without any proof having emerged. Notably, computers across the globe have been infected – an early example of cyber collateral damage.

These instances notwithstanding, in the U.S. the spotlight remains fixed on China, and U.S. authorities, politicians, pundits and media, perceiving China through the prism of the all-powerful State-controlled past – which is no longer a universal reality – regularly hand-wring about the potential for independent Chinese companies to do the Government’s bidding.

There are certainly some legitimate concerns to be had, but the legitimacy gets all too easily and quickly lost in fear- or politics- or commercially-competitive-based spin. After all, who’s to say what passes for a “Chinese” company today? If one were to be even marginally intellectually honest, and acknowledging for the sake of argument that the Chinese Government is just as committed to cyber tactics as is the U.S., wouldn’t one acknowledge that any company with a presence in China is vulnerable to Chinese Government manipulation, however well-hidden that might be?

Let’s consider this from the perspective of the information communications technology industry, one which has become utterly globalized, resulting in virtually every major ICT company having significant research and development, production and software coding capabilities in China. Why? Well, among other things, comparatively speaking, China possesses rich resources in available talent and low labor costs. Indeed, in 2010, China's college graduates reached 6.31 million, while in the U.S., the figure was 1.65 million. And, the average salary for an engineer in China remains below $10,000 a year, with the average disposable income per capita resting below $3,000, while in the U.S., it’s around $50,000 (and engineers command salaries many multiples of their Chinese counterparts). All of these – and other- advantages have attracted global ICT companies to move manufacturing bases and significant R&D functions to China.

So what does this mean in practice, in terms of major ICT players that supply the guts and intelligence to cyber-threatened global networks?

Ericsson: Ericsson opened its first office in China in 1985 and as of 2009 had 7,900 employees in China, 27 offices and 10 joint ventures. Ericsson’s second largest global supply hub is in Nanjing, China, producing wireless network equipment - over 50% for export. And, Ericsson has over 1700 R&D personnel in China and an annual R&D investment in excess of $155 million, developing as many as 100-150 products each year for Ericsson’s global markets (indeed, Ericsson’s first “3G” (WCDMA) base station was developed by Ericsson’s China R&D shipped to Europe in 2004). And, finally, Ericsson has a strong China-based service Organization featuring 36 customer network support centers and 5,000 local engineers.

Alcatel-Lucent: Shanghai Bell Telephone Equipment Manufacture dates back to 1983 (pre-Lucent AT&T) and, after uniting with Alcatel’s China-based operations following the Alcatel-Lucent merger in 2006, was ultimately renamed Shanghai Bell Co, Ltd in 2009. Shanghai Bell, employing approximately 10,000, is a 50-50 joint venture between Alcatel-Lucent and China’s State-owned Assets Supervision and Administration Commission of the State Council. Shanghai Bell hosts several China-based global R&D centers employing over 6,000 people, has full access to Alcatel-Lucent’s global technology resource pool and develops technologies that serve all of China and over 50 countries worldwide. And, Shanghai Bell’s two Chinese manufacturing bases generate products for fixed-network, mobile, optical, and multi-media with annual production values of approximately $2.48 billion.

Cisco: Since its entry into China in 1994 and the 1998 establishment of Cisco Systems (China) Network Technologies Co. Ltd., Cisco has promoted the development of Chinese innovation and the Chinese ICT industry. In1998, the Cisco Network Technology College project officially entered China establishing over 220 Cisco Network Technology Colleges that teach comprehensive courses on the latest network technology. In 2005, the Cisco China R&D Center was launched in Shanghai, accompanied by promises to further invest $37.7 million to co-construct 35 model software colleges along with China Ministry of Education. And, in 2007, Cisco announced investments and joint ventures in China totaling $16 billion, committed to expand its Networking Academies to 500 to train an additional 100,000, and to double its manufacturing in China (a production value of as high as $14 billion).

Intellectual honesty would demand an acknowledgment that to the extent that cyber security concerns are real (and they are), then they apply to all of these global companies with operations spread across the globe, including in China. And yet, in the U.S., the focus – for political and competitive reasons – circles around global players with a Chinese heritage, like Huawei, the second largest telecommunications equipment provider on the planet.

Why? Well, Huawei is based in China and the U.S. and Chinese Governments are engaged in competition on multiple fronts, from politics to economics, and beyond. And, well, like the U.S. Government, the Chinese Government has been vocal about its cyber-intent and, certainly more public than any American activities, China-based cyber-incursions into foreign networks are well- and regularly-reported. So, with all of that in mind, ill-founded beliefs that Huawei is somehow state-influenced contribute to ill-founded fears that Huawei might facilitate Chinese Government-endorsed espionage or disruption.

Without getting into the silliness of such concerns in the context of a global leader with a presence in 140+ markets and far more sales outside China than within, intellectual honesty would still demand that any true solution to cyber security concerns would demand agnosticism. Consider:

The quality and integrity of Huawei solutions have been audited and passed the security requirements of 45 of the world’s top 50 global operators and no company or government has found Huawei solutions to vary from international standards in any manner material to security. These are facts. And, given that Huawei’s solutions are built to the same global standards as those of competitors, all of which manufacture product and code software in China and all of which share common potential vulnerabilities in component and code origin, manufacturing, logistics, distribution, installation and support, it is intellectually honest to say that Huawei’s solutions are no less secure than the equipment its ICT peers.

So where does this leave us? Well, if we take a fact-based, intellectually honest and politics-free approach, we should all agree that legislation, regulation or policy intended to address cyber-security concerns based on a company's country of headquarters is akin to throwing a mosquito net over a reservoir to prevent an outbreak of cholera…

…Not only is the prophylactic mis-used (mosquito nets are of course meant to manage the spread of pest-borne malaria), but such measures do nothing to address the true issues of plumbing, sanitation and water supply.

The facts are that true, rational and effective solutions to cyber-security concerns will only emerge from an industry-led, non-politicized, pragmatic process that acknowledges the common vulnerabilities of all ICT companies and addresses the challenges in a manner agnostic to nationality.

Later...

Calling Foul On Exim's Huawei FUD

In a speech at the Center for American Progress in Washington, D.C. on June 15, 2011 (yesterday), Fred Hochberg, the Chairman and President of the Export-Import Bank of the United States, detailed "How the U.S. Can Lead the World in Exports: Retooling Our Export Finance Strategy for the 21st Century." Among other things, Hochberg bemoans "the proliferation of state-directed capital into the global marketplace" as disadvantaging U.S. firms. To the extent that such concerns are fact-based, they are legitimate. However, the legitimacy of Hochberg's arguments is effectively gutted by his willy-nilly parroting of what would seem to be competitor-inspired talking points.

Hochberg's speech (full text linked here), makes a number of factually false references to global telecom giant Huawei (recall, I work there).

Per Hochberg: "...One of the central reasons the company’s growth has been so dramatic – is that it’s backed by a $30 billion credit line from the Chinese Development Bank. This backing allows Huawei to significantly reduce its cost of capital and to offer financing to their buyers at rates and terms that are better than their competitors. This financing model not only affects the bottom line of companies trying to compete, but it also affects the bottom line of our economy – particularly as exports play an increasingly important role in our economic recovery and job creation. The reality is opaque state-directed capital allows foreign governments to target their financing at specific sectors and companies, while aggressively grabbing market share in an attempt to dominate a market."

All of that would be disturbing, if it were true. But it's not. And it is increasingly disturbing to hear U.S. government voices repeating statements that are patently false, and known to be so.

The facts:

The China Develop Bank (CDB) and Huawei have signed Memoranda of Understanding (MOUs) under which the CDB has indicated its willingness to make available export credits to potential Huawei customers. Such MOUs, which serve as marketing vehicles for the CDB to gain overseas business, are not the same as Lines of Credit because there are no funds actually committed by the CDB. One such MOU was signed in 2004 referencing $10 billion in credits with a five year validity period. A second MOU was signed in 2009 referencing $30 billion, also with a five year validity period. Since 2005, 35 Huawei customer projects have tapped the CDB export credits, with the aggregate amount of financing agreed to totalling $4.25bn, but with only $2.99bn having actually been extended to Huawei customers - at going market rates and according to open market-based practices. Huawei’s global sales over the same period exceeded $110 billion. Clearly, Huawei's growth is not driven by CDB or other "state-directed" support.

So, while we're at it, let's consider some additional facts. How does Huawei finance itself? Well, in terms of external financing,mainly through loans from commercial banks. Since 2000, with the growth in international markets and in order to prevent systemic risks, Huawei has adopted a diversification strategy in terms of financing resources, types and terms. Huawei now collaborates with 28 banks: 10 China-based and 18 non-China-based banks (Note: Huawei is now one of the top 50 global platinum customers of HSBC Bank, Citibank and Standard Chartered Bank). In total, these commercial banks have granted $25 billion in credit facilities to Huawei, at going market rates and terms, in compliance with the credit policies of each commercial bank, and in accord with relevant national and international laws and regulations. To date, Huawei has utilized $3.58 billion of the $25 billion, over 50% drawn from non-China-based banks.

Facts. They can be fun. Indeed, let me repeat one more set (verbatim from my June 5, 2011 post - linked here):

In his speech at the Center for American Progress, before blasting Huawei, Hochberg poses a number of rhetorical questions about America's long-term economic growth, quality of life and competitiveness. Perhaps Hochberg and others that view companies like Huawei through the complex geo-political prism of the U.S.-China relationship should jettison the politics and actually consider the answers to those very questions that he poses. Consider, for instance, the significant contributions Huawei makes to American innovation and livelihoods. In order to fuel Huawei’s global supply chain, in 2010 alone Huawei purchased more than $6.1 billion from major U.S. technology companies, indirectly sustaining over 30,000 U.S. jobs in addition to the 1,100 U.S.-based workers Huawei employs directly. Beyond that, each year, Huawei invests about 20% of its North American revenues into local R&D, totaling $135 million in 2010 alone. Yet further, Huawei is committed to university partnerships to foster the next generation of American telecommunications experts, investing more than $10 million in 2010 to support programs at Georgia Tech, Harvard, MIT, Stanford, UC Berkeley, UC Irvine, UCLA, UC San Diego, UT Austin, UT Dallas, Washington University and Yale University.

Food for thought...