Forgot your password?
typodupeerror
Security Communications Encryption Government IT Your Rights Online

India, China Try Import Regulations As Security Tools 108

Posted by timothy
from the you-can't-enter-our-theme-park dept.
An anonymous reader writes "The Register reports that the Chinese government is forcing vendors to cough up the source code to their encryption alogrithms before they can sell their equipment to the Chinese government. The EU doesn't seem to like it, but if I were in their position I'd want the same thing." China's biggest neighbor goes further; another anonymous reader writes "Telco equipment from China could have spyware that gives access to telcom networks in India. The Indian government has officially told mobile operators not to import any equipment manufactured by Chinese vendors, including Huawei and ZTE. The ban order follows concerns raised by the Home Ministry that telecom equipment from some countries could have spyware or malware that gives intelligence agencies across the border access to telecom networks in India. The biggest gainers from the move could be Ericsson, Nokia, and Siemens, which have been losing market share to aggressive Chinese equipment-makers in India."
This discussion has been archived. No new comments can be posted.

India, China Try Import Regulations As Security Tools

Comments Filter:
  • by al0ha (1262684) on Thursday April 29, 2010 @03:27PM (#32035406) Journal
    are the ones that are open to peer review. So Kudos to the Chinese for being smart enough to make these idiot companies with closed-source encryption technologies provide them with the source code for review. Good encryption does not rely on obfuscation of code and processes!
    • by srussia (884021) on Thursday April 29, 2010 @03:32PM (#32035486)
      Security through security!
    • by Anonymous Coward on Thursday April 29, 2010 @03:40PM (#32035636)
      I don't think that's why they want to view the source code...
      • Re: (Score:2, Insightful)

        by Anonymous Coward

        Regardless of whether that's why they want to view it or not, the net effect is that only robust algorithms will be exported to China. Everybody can get the code to GPG, but that doesn't make the keys invalid.

        • Re: (Score:3, Insightful)

          by rtfa-troll (1340807)

          The effect of giving the Windows source code to China seems to have been that people in China used it to break into Google and tens of other major corporations. Why should this be any different? There are expert groups in China who will find vulnerabilities in the systems and then, instead of having to have trojanised equipment from their own vendors, they will be able to attack the other vendor's equipment just as well.

          What's really funny is that India is stopping buying Chinese made teleco equipment w

          • by _merlin (160982) on Thursday April 29, 2010 @07:13PM (#32038432) Homepage Journal

            What's really funny is that India is stopping buying Chinese made teleco equipment whilst other countries like the US; also great friends of China (when will you stop blocking their discipline against the rebel province of Taiwan???) still continue to buy Chinese.

            No, it's actually quote logical. You see, for Western countries, China is a nominally communist "bad guy" that conveniently serves as an example of what the opposite of their idea of "freedom" would be. In practice, they're too distant for this to cause any change in behaviour, and buying their cheap products seems to keep the plebs happy. OTOH, India and China are highly populous nuclear armed mega-countries that share a disputed land border (see Arunachal Pradesh) - that warrants a degree of caution when dealing with each other.

          • The effect of giving the Windows source code to China seems to have been that people in China used it to break into Google and tens of other major corporations.

            Come again?

            You mean Google is running on Microsoft Windows' code ???

            No, I ain't trying to be funny. I just can not put the 2 and 2 together.

            Having Windows code is one thing, cracking Google is another thing altogether.

            • by Bert64 (520050)

              Google's services aren't running on windows, but their office staff are and that's where the point of entry was... Once you start keylogging workstations it doesn't really matter how secure other servers are.

          • by Bert64 (520050)

            However the Chinese also have the source code to Linux, BSD, Solaris etc but they still targeted windows.

          • by daem0n1x (748565)

            The effect of giving the Windows source code to China seems to have been that people in China used it to break into Google and tens of other major corporations.

            What does one thing have to do with the other? What have you been smoking?

            Why should this be any different? There are expert groups in China who will find vulnerabilities in the systems and then, instead of having to have trojanised equipment from their own vendors, they will be able to attack the other vendor's equipment just as well.

            Great, so let's make all encryption algorithms secret. Security through obscurity has worked sooooo well in the past...

            What's really funny is that India is stopping buying Chinese made teleco equipment whilst other countries like the US; also great friends of China (when will you stop blocking their discipline against the rebel province of Taiwan???) still continue to buy Chinese.

            Can India afford that, or are they just bluffing? And why do you think it's your job to "block" a sovereign country on an internal issue? Would you like the Chinese to "block" you if California wanted to become independent? Mind your own fucking business!

            The fact that you were modded 5+ Insigthful for this craz

            • What does one thing have to do with the other? What have you been smoking?

              The break in to google was based on a windows / IE vulnerability which was otherwise unknown. Looking through articles about it it's pretty clear it ends up as "state actors" from China. In other words, exactly they people MS gave source code access to.

              Great, so let's make all encryption algorithms secret. Security through obscurity has worked sooooo well in the past...

              Or how about using one of the standard open source well studied implementations? What's wrong is the idea of giving the source code to China and leaving all other users in the dark.

              Can India afford that, or are they just bluffing?

              The can't afford not to. China and India are in a state of more or less co

        • by RockDoctor (15477)

          Regardless of whether that's why they want to view it or not, the net effect is that only robust algorithms will be exported to China.

          Oh dear, the second logical fallacy of the day. That I've noticed.

          The article (not that I've read it) does not imply this ; the most that the article implies is that the only firmware algorithms that will be accepted by China will be those that it's code reviewer(s) think are robust. And there is no guarantee that the reviewers will be competent for this task (this is not to

      • What is your theory then?
    • by Monkeedude1212 (1560403) on Thursday April 29, 2010 @03:55PM (#32035856) Journal

      Hey, MD5 was perfectly fine until your type started investigating it.

      See, we've had Quantum Encryption for a while now!

    • Re: (Score:3, Insightful)

      If only the State governments were that smart. Who the hell knows what's inside the Diebold voting machines? When working with the Defense Department we're expected to provide all the code for review.

    • Re: (Score:2, Informative)

      by Mike McTernan (260224)

      smart enough to make these idiot companies with closed-source encryption

      It's often overlooked that GSM development started in 1982. At that time computing power was a fraction of what it is now and DSPs, rather than dedicated logic used in today's chipsets, would be used for the first implementations of this new technology. Mobile phones are also very power sensitive devices - battery life is very important.

      So given these pressures, some corners had to be cut to make the system workable on the available

    • are the ones that are open to peer review. So Kudos to the Chinese for being smart enough to make these idiot companies with closed-source encryption technologies provide them with the source code for review. Good encryption does not rely on obfuscation of code and processes!

      I'm not disputing your premise, but adding a rider- sending your source code to somebody who has no intention of telling you about the holes they found (and might be planning to abuse them instead) won't help you or your other customer

  • Trust (Score:4, Insightful)

    by WrongSizeGlass (838941) on Thursday April 29, 2010 @03:30PM (#32035462)
    This seems like a natural progression down the line of diminishing trust between countries. It's not very surprising, especially since the Chinese government *may* have been 'supportive' of some of the China/Google hacking. It appears the downside of possibly endorsing or supporting security breaches is other people/countries/etc will suspect you of it from that point on.

    I can't blame the Chinese government for wanting to have the encryption information ... and I can't blame India for not trusting Chinese technology. Nobody wins when no one trusts each other.
    • Re:Trust (Score:5, Insightful)

      by FooAtWFU (699187) on Thursday April 29, 2010 @03:35PM (#32035534) Homepage

      I'm just reminded of the old security-oriented definition of Trust: the person you trust is the person who can break your security. It's a perfectly healthy attitude to trust people (/businesses/nations) as little as possible when the security of your data is at risk. In arena of IT security, we need less "trust" and more "verify".

    • by c0d3g33k (102699)

      This seems like a natural progression down the line of diminishing trust between countries. It's not very surprising, especially since the Chinese government *may* have been 'supportive' of some of the China/Google hacking. It appears the downside of possibly endorsing or supporting security breaches is other people/countries/etc will suspect you of it from that point on.

      You might also consider that if they are spying on their own citizens via spyware installed by the manufacturer (at government insistence), they realize fully well that it can be done to them via software or equipment from sources not under their control. No need to invoke the Google hacking - that was just a sloppy fiasco. The government hacking "bay of pigs", if you will.

    • Re: (Score:1, Insightful)

      by Anonymous Coward

      Nobody wins when no one trusts each other.

      It certainly helps maintain some diversity, which is otherwise all but killed off by globalization. Without diversity, there's no competition.

    • Re: (Score:3, Interesting)

      by timeOday (582209)

      This seems like a natural progression down the line of diminishing trust between countries.

      I could just as well see it as a progression reflecting increasing levels of economic interdependence. Granted, economic interdependence isn't quite the same thing as trust - it's more substantial; it's trust expressed through actions.

    • Re: (Score:2, Insightful)

      by OhHellWithIt (756826) *

      I can't blame the Chinese government for wanting to have the encryption information ... and I can't blame India for not trusting Chinese technology. Nobody wins when no one trusts each other.

      What about the domestic producers of encryption equipment? Don't they stand to gain a little through sales to their government, whether it be India, China, or the U.S.A.?

      For my part, I don't understand why any government trusts producers of other countries for their critically sensitive information. In the U.S., we know that our "friends", like Israel, engage in espionage, and I'm pretty sure we spy on them (although I have no evidence to back it up other than fuzzy recollections of news articles

      • Re: (Score:1, Insightful)

        by Anonymous Coward

        How do I know that a U.S.-produced item doesn't have a back door for NSA to use?

        Always assume that it does. If you are wrong, good. If you are right, you are prepared.

      • by Bert64 (520050)

        Domestic publishers could insert backdoors too... The government should be demanding source code for review in all cases, and verifying that the devices they get are actually running the source they've seen.

    • Re:Trust (Score:5, Insightful)

      by Arker (91948) on Thursday April 29, 2010 @04:08PM (#32036046) Homepage

      Nobody wins when no one trusts each other.

      Au contraire, when it comes to security, everyone wins when no one trusts each other.

      The chinese move, at least, is long overdue. No one should ever trust a device whose source code is secret.

    • I can't blame the Chinese government for wanting to have the encryption information ... and I can't blame India for not trusting Chinese technology. Nobody wins when no one trusts each other.

      But there *are* winners !

      In the case of India not importing Chinese equipments, the Japanese, European, Korean, and American companies suddenly become the de facto winners.

  • Copying (Score:5, Insightful)

    by mwvdlee (775178) on Thursday April 29, 2010 @03:31PM (#32035474) Homepage

    If you're going to give your source code to the Chinese, you know for certain they will copy it and never buy a product from you again.

    • Re:Copying (Score:5, Funny)

      by Jawn98685 (687784) on Thursday April 29, 2010 @03:38PM (#32035600)
      Yes, but you can then buy "Genyooine Cisko Router" for only $199 American dollar, so is good deal for everybody.
      • Re:Copying (Score:5, Funny)

        by game kid (805301) on Thursday April 29, 2010 @03:49PM (#32035770) Homepage
        That one sucks. I prefer "Ginuwine Sisqó Router" because its Web interface has lots of thongs and double entendres.
        • Re: (Score:3, Funny)

          by grcumb (781340)

          That one sucks. I prefer "Ginuwine Sisqó Router" because its Web interface has lots of thongs and double entendres.

          Bollocks. My Honour Brand Enlightened Crisco router also makes our fried chicken taste less greasy. It's true! I took the paper towel test!

          The missus loves it.

    • Re:Copying (Score:5, Interesting)

      by Myji Humoz (1535565) on Thursday April 29, 2010 @03:59PM (#32035926)
      How does giving the source code for an encryption algorithm equate with giving the sourcecode for the hardware?

      For that matter, how the heck does giving someone the source code (controlling software, drivers, encryption, backup algorithms, etc) equate with giving them blueprints for your hardware?

      Mindless Chinabashing at its best.
      • Re: (Score:2, Informative)

        by mwvdlee (775178)

        China has a very bad track record when it comes to copyright protection and the production of knock-off products. It is true that software is only part of a product, but there's no need to make it any easier for them.
        Chinabashing it may be, but mindless it sadly is not.

  • ... will your wonders never cease?

  • by c0d3g33k (102699) on Thursday April 29, 2010 @03:48PM (#32035732)
    Unless the source can be compiled from scratch and used in place of the pre-compiled versions, including flashing of firmware, creation of installable ROM images or OS installs, having source code guaranteed by analysis to be exploit-free gains the user nothing. There could still be spyware in the final product. Short of self-installing, I guess creation of bit-equivalent or checksum-equivalent binaries would be good enough as a verification mechanism.
    • by Arker (91948) on Thursday April 29, 2010 @03:56PM (#32035864) Homepage

      Unless the source can be compiled from scratch and used in place of the pre-compiled versions, including flashing of firmware, creation of installable ROM images or OS installs, having source code guaranteed by analysis to be exploit-free gains the user nothing. There could still be spyware in the final product. Short of self-installing, I guess creation of bit-equivalent or checksum-equivalent binaries would be good enough as a verification mechanism.

      It should be common sense that you have to verify that the source code you were given actually compiles to a bit-identical executable in order for the exercise to mean anything at all.

      • by c0d3g33k (102699) on Thursday April 29, 2010 @04:24PM (#32036282)
        Yes, but that's not always the case, even with nominally "Open Source" software that ends up on proprietary closed devices. Tivo comes to mind, as does Android. I can't recall ever reading about building bit-identical executables as a way of verifying that what is running on the hardware is actually the same as the audited source code. Mostly I read the opposite - what actually runs is always different from what the 'open' source can produce, if for no other reason than signing them with a private key. That's enough to slip in some clever assembler routine that can be used as a backdoor, I'm guessing.
        • Re: (Score:2, Informative)

          by Anonymous Coward

          ... signing them with a private key. That's enough to slip in some clever assembler routine that can be used as a backdoor, I'm guessing.

          Nope. Signed files are designed so that you can extract the original data minus the signature and calculate a hash on it. Otherwise you could never check the signature.

          And since you can extract the original data, you can compare it to your own build.

          Signing does not provide a backdoor.

      • It's hard to test a linux kernel build for instance, because it embeds the time of the kernel build (and other information) into the kernel binary itself.

        • by Arker (91948)
          As long as it's not deliberately obfuscated it would not be difficult to account for that.
  • I wonder how the fact that India and China went to war [wikipedia.org] in 1962 impacts these decisions. They also still share a disputed border.

    Would not surprise me if this influences how the Indian government feels about their telecoms using equipment from ZTE or Huawei.

  • by sznupi (719324) on Thursday April 29, 2010 @03:54PM (#32035836) Homepage

    Yes, India is, like, right now [bbc.co.uk] in the process of auctioning 3G licenses. This will really bring benefits to Ericsson and Nokia Siemens.

  • by daoshi (913930) on Thursday April 29, 2010 @03:54PM (#32035838)

    I think China's move makes sense - they just want to check and make sure there is no backdoor in your code/algo. As an earlier post said "Good encryption does not rely on obfuscation of code and processes." They trust what the users want to encrypt, just making sure the devices are not leaking the info to uninvited parties.

    As for India, this is very bad. They are just paranoid. This sets up a very bad example. They are scaring off all the business partners and hence the opportunities. Think if you are a vendor, how can you be sure that they would never do the same thing to you one day?

    • Re: (Score:1, Insightful)

      by kubitus (927806)
      Google also had to find out that China does not want backdoors - unless they are their own.

      .

      I would recommend every government, company or institution to use especially network devices only, if they can review and then compile the code themselves which is to be run in the device.

      So as to avoid Trojan Boot Loaders within their networks.

  • by Anonymous Coward
    actually Alcatel-Lucent will benefit from this. They have low priced telecom equipment and they have been replaced in many countries by even cheaper Huawei.

    But isn't this strange? They put a ban because chinese "could have spyware or malware" in their equipment. Isn't this like putting someone in jail because he might do something bad in the future?

    Here is my conspiracy theory: big companies export corruptions in the developing countries (this is a fact). Some companies could just not compete with the c
    • by vadim_t (324782)

      But isn't this strange? They put a ban because chinese "could have spyware or malware" in their equipment. Isn't this like putting someone in jail because he might do something bad in the future?

      Why is it strange? I'm pretty sure the FDA does something quite similar to this. You can't sell a medicine made of undisclosed components.

  • Isn't Russia China's biggest (at least by area) neighbor, not India?
  • by ThermalRunaway (1766412) on Thursday April 29, 2010 @04:00PM (#32035940)
    I have worked in the defense industry for a while, and used to work in the "Government" division of a major telecom company.

    One project we had worked on was encrypted cell phones for gov use. Our customers were only interested in a solution that was top to bottom US made from cleared companies. The chipset, OS, drivers, etc, were all built in the US, so there was no issue of "back doors"

    I also heard rumors at one point about some contractor actually finding mal-ware type SW embedded in the firmware of Lenovo laptops that could sort of call home to momma. I've never seen Lenovo boxes around after that.

    I think these issues are going to be bigger than just a single point in the infrastructure chain. With so much cyber activity going on, I think many countries are going to face the same sort of issue India is trying to prevent.
    • Glad to see you mention the vulnerabilities that can be introduced via the chipsets...a lot of people focus on the code and don't understand what you can do with a single chip - and "invisibly", for all practical purposes.
  • TFA doesn't say that (Score:2, Informative)

    by Mr Otobor (1097177)

    First off, TFA article doesn't mention source code; second, it quite explicitly says 'details are murky' and it is unclear what the PRC is asking for. At least as far as the article goes, that is what is said.

    Second, to some comments: Other countries already have various schemes in place for reviewing code (which doesn't preclude flaws or backdoors, intentional or not, from being included in compiled / embedded code...)

    India is saying what other countries fear, but since they are in China's backyard and v

  • The future... (Score:3, Insightful)

    by MikeRT (947531) on Thursday April 29, 2010 @04:03PM (#32035982) Homepage

    The idea that corporations that bowl over the largest nation states is our future has always seemed strange to me. Multinationals are really just a legal fiction that exists simultaneously in multiple countries. At any time, a political system can create problems that will effectively bring that multinational to its knees.

    I think the future for big business is identical, only a little further out, to that of big government: replacement by small, agile businesses. Big business exists mainly because of big government and cooperation between the same. I think we're going to see a future in which each major country may trade for some tech products, but you'll see conditions begin to favor agile, much smaller businesses that can efficiently produce most important things at home.

    • Re:The future... (Score:5, Interesting)

      by ibsteve2u (1184603) on Thursday April 29, 2010 @04:57PM (#32036806)

      see conditions begin to favor agile, much smaller businesses that can efficiently produce most important things at home

      I tend to disagree; while conditions may differ elsewhere, our Supreme Court's transformation of corporations into super-citizens will in fact encourage corporations to become ever bigger so as to ever better afford the purchase of both political advertising and politicians. Given enough political control, a corporation can simply and effectively modify the rules of the game to make "doing business" prohibitively expensive or complex unless you are already of sufficient size.

      And they will do that; the important thing to remember is that our corporations have grown themselves to the size that they are now for the competitive advantage that size provides in the pursuit of profit; they do not, in fact, like competition, and size provides more and better opportunities to eliminate competition.

      lolll...ask Wal*Mart.

  • by M_Hulot (859406) on Thursday April 29, 2010 @04:08PM (#32036050)
    The headline suggests that China is using import rules to bolster security. I think it is the other way round. They are using the demand for source code as a barrier to trade to (unfairly) help domestic firms. Not very many overseas firms are going to provide source code, leaving the market open to Chinese firms.
    • I definitely agree with you, but I'd take it one step farther.

      By issuing this as a security restriction they are completely circumventing the WTO, which would otherwise slap them with export tariffs.

    • Re: (Score:3, Insightful)

      by orasio (188021)

      The headline suggests that China is using import rules to bolster security. I think it is the other way round. They are using the demand for source code as a barrier to trade to (unfairly) help domestic firms. Not very many overseas firms are going to provide source code, leaving the market open to Chinese firms.

      I would agree with you if you didn't say "(unfairly)".
      Access to source code is a legitimate security concern. Fair trade doesn't mean that you can't set high standards if foreign providers can't reach them.

    • Good try. But do you know every other piece of imported hardware and semiconductor chip are smuggled into China, just to avoid the tariff. It is another open secrete in China.
  • by Anonymous Coward on Thursday April 29, 2010 @05:00PM (#32036862)

    in the 80's and 90's American manufacturers gave away their technology to the Chinese to get a piece of the huge Chinese market. This allowed the Chinese to modernize their manufacturing technology by decades in a few years. Then instead of opening their markets, China flooded the world markets and decimated the foreign competition.
    One might hope managers of corporations would learn from the past...

  • Go India! Everyone should ban electronics made in China given China's general proclivity towards industrial espionage.

  • I think ALL governments should behave this way. If government is to take its own data security seriously, the boxes they use should not be "black boxes." For commercial business this should also be a rule but so far, business trusts closed source software and devices running on closed source software... well, not all businesses... not Ernie Ball ... not London Stock Exchange... but most businesses.

    At some level, we have to trust technology though... seriously, I don't know what's in the Linux kernel. I

    • just having access to the software source is terribly inadequate to address security concerns. a kill switch can be easily implemented in hardware as a tiny, insignificant chip. now if you are going to have every single piece of equipment reviewed by hardware experts, then ok. but i dont think that is practical.
  • by orlanz (882574) on Thursday April 29, 2010 @06:15PM (#32037836)

    I think India isn't doing the restrictions for Trust or Security reasons. Their politicians couldn't care less. For the right price, they will sell you a state or two.

    It probably has more to do with keeping knock off China phones off the markets to keep the big corps happy. In India, there is rampant import of Chinese knockoff phones. An HTC becomes a HIC. They add a little line at the bottom and cut the price from $400 to $50. I kid you not. Quality control is an issue, but if you have the right connections, that won't be a problem. The phone is from the same factory that makes the name brand, its the same materials, same machines, and same people. Just the 3rd shift of lineman and it doesn't go through QC before shipment.

    So for sometime, the India government has been pressured to put a stop to this import. They haven't been very successful but that doesn't mean they don't look like they are trying. Exactly how do you stop 50 individually owned stores stuffed into an area the size of a CVS from selling the same stuff to a population that creates a massive amount of demand but isn't willing to pay like credit based Americans are. Not to mention your enforcement divisions are willing to look the other way for a dollar of that $50 sale. Additionally, the worst offenders are the politicians and those connected to them.

    • I think India isn't doing the restrictions for Trust or Security reasons. Their politicians couldn't care less. For the right price, they will sell you a state or two.

      sadly true for many state governments.
      but i think the government at the center is not that corrupt. this really is a security concern. the problem is that we don't have the kind of expertise to review each device individually for secret, kill-switch, call-home chips.
      on the other hand china requiring source code won't do much about security, since it is easier to incorporate a tiny chip. imo, this is simply about not having to develop their own software.

  • More then anything, India is probably retaliating for China teaming up with Pakistan on nuclear technology.

  • I picked up a lovely dirt-cheap Chinese wireless card a month ago (Tenda from Jaycar in Oz for those interested).

    Upon installation, the windows kept losing focus - type-type-type.. wtf (clicked back into the window).

    Thought I'd watch the network traffic a bit, and sure enough; type-type-type.. window loses focus... network traffic spikes a smidgen...

  • So India is worried about backdoors in products from China, but is not worried about backdoors being present in products from other countries?
    They should be worried about any proprietary products from any country... China isn't the only country that might want to spy on India.

  • It is one thing to have something that is labeled ''source code to the product'' and to be sure that this is exactly what was used, eg no little extra ''tweak'' hidden in a system macro that leaves a security back door. If they are serious about this they will insist on compiling the source on one of their machines and check that it matches the binary that is shipped with the product.

    All of this is a lot of work and will take a lot of time, who is going to pay for it ?

    If they don't recompile it then the

Never trust a computer you can't repair yourself.

Working...