[GTALUG] Google suspends some business with Huawei

[D. Hugh Redelmeier]

| From: Kevin Cozens via talk <talk at gtalug.org>

| Have any of the allegations against Huawei been proven or is Trump just doing
| this based on suspicions or rumours similar to the claims made that Russians
| tampered with a US election?

There are several kinds of allegations against Huawei.  I assume that
you are referring to the ones that say their equipment is a security
threat.  (There are also allegations of trading with North Korea or
Iran and of IP theft.  Also of secret ownership by the Government.
Not that ownership matters since the government can non-transparently
direct the company to do anything.)

Phones (end-point-devices) ought to be in a different class from
carrier equipment.  Since phones are in the hands of millions, the
system ought to be designed to survive compromised phones.

So banning Huawei handsets look suspect.  Banning their use of Android
seems suspect AND stupid.

Banning Huawei carrier equipment is a different matter.

I am unaware of concrete claims.  But that's fair:

- If I were the NSA, I would not want to reveal what I know

  - it might reveal how I found it out

  - it would reveal which systems of the opponent had been compromised

- "sleeper" compromises are to be expected.  These would have no
  manifestation until activated.

- putting compromises in a large system is laughably easy and
  impossible to reliably detect.  Heck, we cannot even reliably detect
  bugs, and they were not designed to be hidden.  Compromises might be
  indistinguishable from bugs.

It comes down to your threat model.  The US kind of has to trust its
own companies (if there are any) and maybe its long term allies'
companies.  It probably ought to distrust Chinese companies.

The Chinese government has shown willingness to repeatedly and
flagrantly hack the US (and Canada).  The fact that the US hacks the
other way is irrelevant to this discussion.  We're not talking
morality here.

Canada cannot go to war with the US.  All our sophisticated hardware
likely has kill switches controlled by the US.