BT links with Huawei raise national security concerns, say MPs

Re: Committee says "We're always the last to know!"

Wrong question.

Right questions are (and just for starters):

1. Where has GCHQ was for the last 8 years?

2. Why did we laugh at India when their security center to test their equipment for possible infiltration by a foreign adversary was contracted to be run by Huawei. They were simply following the venerable tradition of copying UK.

There are also a few other "right" questions BT has to answer, but they are better asked under MP legal privilege and not on the register. I think it is time for a letter to my MP :)

Re: They are merely copying the Americans

Completely correct.

And if the Parliament (and their worldwide counterparts) are so concerned about security of their citizen's data, why not look into eg. Microsoft, a known security hole generator and proven snooper of supposedly private communications?

After all, they still fully control over 90% of places where data is being generated, viewed or analyzed, Huawei is nowhere near that kind of dominance.

Re: Good for them

I wouldn't put it quite so strongly as 'nonsense', but I've carried out security risk assessments for clients with Huawei kit, and my conclusions were that there are real threats, such as:

(a) a magic 'off' button - Huawei could configure their systems to shut down on receipt of a specially formed packet (a 21st century 'ping of death') to facilitate DoS attacks;

(b) back doors that could allow an attacker to gain sysadmin access (which also exist, by accident if not design, in many other systems);

(c) analysis of traffic and reporting back to some central point (I think this sort of capability is rather beyond the fairly basic low-level kit that constitutes most of their current installed base, but that will no doubt change in the future as Huawei move up the food chain).

But none of these seem to be very plausible because:

(1) most Huawei kit is installed in China, so they would be just as vulnerable to these attacks;

(2) most such kit is not directly exposed to the Internet. There are firewalls and IDS/IPS systems in the way (hopefully not all Huawei ones!) that would make inbound and outbound access very difficult, if not impossible.

I don't claim to have conducted any exhaustive analysis of the hardware, and I'd welcome comments or corrections. But it doesn't seem to me that any threat is currently very great.

Re: Cost Vs Benefits

Marconi was a dead duck crippled by years of not having a clue what it wanted to do and its kit was at best "substandard" propping it up would be a fools errand. I expect most of the engineers that worked at Marconi found themselves new jobs within a year, at marginally better companies.

Re: Cost Vs Benefits

From what I've heard Marconi et al were happy as larry to price gouge BT at every opportunity for kit.

Re: So what does GCHQ know?

"Given the recent revelations in the Guardian (hat tip to Greenwald) who would trust the lying b*stards that are today's American officials?"

I would suggest the "today's" is superfluous.

And also that your statement could apply to any country, not just the US.