Huawei row: UK to let Chinese firm help build 5G network

[ATG]

Phud said:

ATG said:

You're continuing to jumble up completely unrelated things. The FBI were performing traffic analysis on bulk flow of data across the internet. Could allowing Huawei to provide kit for 5G allow them to do the same? No. Why? Because 5G kit just gets data in small cells on and off the internet; it doesn't provide core bandwidth and routing of the internet. The traffic analysis they could perform could be conducted by anyone with an aerial in the same location.

If you have control of the devices that encrypt and decrypt data, then of course you've got access to the plaintext; you literally hold the keys. Having control of the network makes no difference. MI6 could fax encrypted data to the Kremlin and ask them to forward it to the CIA. Without the keys, the Kremlin can't decrypt the data. They can choose not to forward it, they can doodle on it. They can't read it.

Have a look at Huawei and Cisco lawsuit the core routers have the ability to off load traffic, hence the core is key, also in 5G the radio and edge are not the same as now, the ability of companies to look into data packets is worrying, however it is just a case of who do you let steal/inspect your traffic.

All encryption algorithms are within 3GPP specs.

There is a reasonable argument for excluding Huawei from core routing as that allows traffic analysis and major disruption, but we're talking about the UK's 5G roll out, not core routing. I'm not sure what you mean by "all encryption algorithms are within 3GPP specs". You can encrypt data transfer between two devices using whatever encryption algorithm you care to invent. You can impose whatever authentication method you care to invent. Also I'm not clear what point you're making when you talk about the radio and edge. I'm genuinely interested to understand any concerns. I searched a round a bit and so far haven't found any concerns explained in even vaguely technical terms. Given the National Cyber Security Centre's was comfortable for the UK to include Huawei kit in the 5G roll out, you might think anyone disagreeing would make the effort to explain their case clearly. I genuinely can't find anyone doing that.

[ashleyman]

BlackLabel said:

“Google has suspended Huawei’s access to updates of its Android operating system and chipmakers have reportedly cut off supplies to the Chinese telecoms company, after the US government added it to a trade blacklist last week.

Google said it was complying with an executive order issued by Donald Trump and was reviewing the “implications”, later adding that Google Play – through which Google allows users to download apps – and the security features of its antivirus software Google Play Protect would continue on existing Huawei devices. New versions of its smartphones outside China would lose access to popular applications and services including Google Play, Maps and the Gmail app.”

https://www.theguardian.com/technology/2019/may/19...

This is important. Google doesn’t have anything to do with this. The US placed Huawei on the list for violating US sanctions and for national security reasons. This means Huawei cannot use US made components in their products. Google service are considered US product.

Google is legally not allowed to allow Huawei to use their services. If anyone is loosing out here it’s Google. From what I can tell this is only on NEW devices and not on ones already sold. I think current phones will still be able to access services, but not updates.

I think this is also affecting companies like Intel. US based, US product. No longer allowed to sell to Huawei.

[Phud]

ATG said:

There is a reasonable argument for excluding Huawei from core routing as that allows traffic analysis and major disruption, but we're talking about the UK's 5G roll out, not core routing. I'm not sure what you mean by "all encryption algorithms are within 3GPP specs". You can encrypt data transfer between two devices using whatever encryption algorithm you care to invent. You can impose whatever authentication method you care to invent. Also I'm not clear what point you're making when you talk about the radio and edge. I'm genuinely interested to understand any concerns. I searched a round a bit and so far haven't found any concerns explained in even vaguely technical terms. Given the National Cyber Security Centre's was comfortable for the UK to include Huawei kit in the 5G roll out, you might think anyone disagreeing would make the effort to explain their case clearly. I genuinely can't find anyone doing that.

The finer details of what Huawei is meant to be able to do and how they do it is not really suitable for open discussion here, IMHO, however the issue people have is that there have been issues and the accepted view that no Chinese company is excluded from working for the government, it was a recently passed law in China that every company will assist ( I think that's how it was phrased) with any request from the government to pass any information asked for by it.

with regards to 5G the network breaks in to two very different areas in 5G, far more than prior mobile networks, so more computing is at the edge, the 5G core is looking more like the internet construct which means touch points can vary with each packet. So it is what might may be done with this data since everything is looking to be transmitted around on these networks.

I would guess that the USA would have a bogey man, in this case it is China, who have copied/imitated others IPR on top of the Chinese governments directive.

Perhaps the largest question is can Huawei really be a private company in China with no links to the power people, the founder was PLA and set up when China was more insular than now.

[Carl_Manchester]

ATG said:

Given the National Cyber Security Centre's was comfortable for the UK to include Huawei kit in the 5G roll out, you might think anyone disagreeing would make the effort to explain their case clearly. I genuinely can't find anyone doing that.

Mate, they have not approved it for network use. We are ripping it out in many places of the country. What they have done is given a fig leaf and setup an ‘oversight board’ just for people who want to ‘risk manage’ the use of their kit.

[ATG]

Phud said:

The finer details of what Huawei is meant to be able to do and how they do it is not really suitable for open discussion here, IMHO,

Why on earth not?

Phud said:

however the issue people have is that there have been issues and the accepted view that no Chinese company is excluded from working for the government, it was a recently passed law in China that every company will assist ( I think that's how it was phrased) with any request from the government to pass any information asked for by it.

Yes but they can't hand over information that they don't have. What data do people think Huawei will be able to gather and handover that would make it dangerous for the US to share intelligence data with the UK, for example?

Phud said:

with regards to 5G the network breaks in to two very different areas in 5G, far more than prior mobile networks, so more computing is at the edge, the 5G core is looking more like the internet construct which means touch points can vary with each packet. So it is what might may be done with this data since everything is looking to be transmitted around on these networks.

"edge" is just putting compute next to the edge of the network. _If_ a developer chooses to decrypt sensitive data on an "edge" server running on some Huawei kit, then more fool them. Just as you wouldn't choose to do that on some dodgy cloud infrastructure, you wouldn't choose to do that on a dodgy edge node either.

Phud said:

I would guess that the USA would have a bogey man, in this case it is China, who have copied/imitated others IPR on top of the Chinese governments directive.

Perhaps the largest question is can Huawei really be a private company in China with no links to the power people, the founder was PLA and set up when China was more insular than now.

And that's a political and economic question that has which has nothing to do with security.

[ATG]

Carl_Manchester said:

ATG said:

Given the National Cyber Security Centre's was comfortable for the UK to include Huawei kit in the 5G roll out, you might think anyone disagreeing would make the effort to explain their case clearly. I genuinely can't find anyone doing that.

Mate, they have not approved it for network use. We are ripping it out in many places of the country. What they have done is given a fig leaf and setup an ‘oversight board’ just for people who want to ‘risk manage’ the use of their kit.

They raised concerns about the quality of their software engineering and the speed at which Huawei addressed (or failed to address) security holes. That's an entirely reasonable concern and network operators can choose to either manage those risks (using a framework suggested by the NCSC) or chuck their hardware out and use new kit, and several telecos are choosing to do the latter. It doesn't make a blanket ban on the manufacturer sensible which is what the US is demanding.

[Phud]

ATG, do you think this is a storm in a t-cup?

I am reluctant, in fact have no intention of going deeper, a lot of folk are worried by who provides our communication networks for many reasons.

[ATG]

Phud said:

ATG, do you think this is a storm in a t-cup?

I am reluctant, in fact have no intention of going deeper, a lot of folk are worried by who provides our communication networks for many reasons.

So far it looks like its primarily a political and economic storm, not one that has a solid basis in actual technical risk. Hence why the authority that is responsible for this stuff in the UK didn't think a ban was necessary, hence why the Prime Minister under expert advice from a variety of sources also did not think a ban was necessary.

When people say "I am reluctant, in fact have no intention of going deeper" either they are into some proper secret squirrel st, or they've been blustering. I am the first to admit that I don't have any expertise in this area. I know a bit about cryptography, a bit about traffic analysis, a bit about networks, a bit about cyber security. If someone could explain a clear risk, please do so. You're not going to be breaking the offical secrets act.

[Phud]

ATG said:

So far it looks like its primarily a political and economic storm, not one that has a solid basis in actual technical risk. Hence why the authority that is responsible for this stuff in the UK didn't think a ban was necessary, hence why the Prime Minister under expert advice from a variety of sources also did not think a ban was necessary.

When people say "I am reluctant, in fact have no intention of going deeper" either they are into some proper secret squirrel st, or they've been blustering. I am the first to admit that I don't have any expertise in this area. I know a bit about cryptography, a bit about traffic analysis, a bit about networks, a bit about cyber security. If someone could explain a clear risk, please do so. You're not going to be breaking the offical secrets act.

I suggest you read why Richard Dearlove highlighted his fears, Mays approach is interesting.

Agree with your synopsis as to why people withdraw from conversations, I wish not to say more.

[ATG]

Phud said:

I suggest you read why Richard Dearlove highlighted his fears, Mays approach is interesting.

Agree with your synopsis as to why people withdraw from conversations, I wish not to say more.

I have. He expresses concern about potential network disruption. He is retired; he left the Secret Intelligence Service 15 years ago. This is not his field of expertise. This is not the Secret Intelligence Service's field of expertise. The National Cyber Security Centre seem to disagree with him. What should we conclude?

[skyrover]

If you have any experience dealing with the Chinese, or an understanding of their culture, there is absolutely no way you would would trust them with your nations telecoms infrastructure.

[Carl_Manchester]

ATG said:

Carl_Manchester said:

ATG said:

Given the National Cyber Security Centre's was comfortable for the UK to include Huawei kit in the 5G roll out, you might think anyone disagreeing would make the effort to explain their case clearly. I genuinely can't find anyone doing that.

Mate, they have not approved it for network use. We are ripping it out in many places of the country. What they have done is given a fig leaf and setup an ‘oversight board’ just for people who want to ‘risk manage’ the use of their kit.

They raised concerns about the quality of their software engineering and the speed at which Huawei addressed (or failed to address) security holes. That's an entirely reasonable concern and network operators can choose to either manage those risks (using a framework suggested by the NCSC) or chuck their hardware out and use new kit, and several telecos are choosing to do the latter. It doesn't make a blanket ban on the manufacturer sensible which is what the US is demanding.

I will be as open as i can on a public forum.

the issue is not primarily about the network. It’s about controlling not just the network. It’s about controlling the network *and* the client endpoints.