Monday 27 January, 2020

Does it make sense to confine Huawei to the ‘non-core’ part of a 5G network?

This seems to be the UK’s fallback position to avoid antagonising the Chinese state (though it won’t mollify the Americans). Bruce Schneier has some interesting things to say about this. Sample:

The 5G security problems are threefold. First, the standards are simply too complex to implement securely. This is true for all software, but the 5G protocols offer particular difficulties. Because of how it is designed, the system blurs the wireless portion of the network connecting phones with base stations and the core portion that routes data around the world. Additionally, much of the network is virtualized, meaning that it will rely on software running on dynamically configurable hardware. This design dramatically increases the points vulnerable to attack, as does the expected massive increase in both things connected to the network and the data flying about it.

Second, there’s so much backward compatibility built into the 5G network that older vulnerabilities remain. 5G is an evolution of the decade-old 4G network, and most networks will mix generations. Without the ability to do a clean break from 4G to 5G, it will simply be impossible to improve security in some areas. Attackers may be able to force 5G systems to use more vulnerable 4G protocols, for example, and 5G networks will inherit many existing problems.

Third, the 5G standards committees missed many opportunities to improve security. Many of the new security features in 5G are optional, and network operators can choose not to implement them. The same happened with 4G; operators even ignored security features defined as mandatory in the standard because implementing them was expensive. But even worse, for 5G, development, performance, cost, and time to market were all prioritized over security, which was treated as an afterthought.

Schneier’s view is that “It’s really too late to secure 5G networks”. 5G security, he says,

is just one of the many areas in which near-term corporate profits prevailed against broader social good. In a capitalist free market economy, the only solution is to regulate companies, and the United States has not shown any serious appetite for that.

What’s more, U.S. intelligence agencies like the NSA rely on inadvertent insecurities for their worldwide data collection efforts, and law enforcement agencies like the FBI have even tried to introduce new ones to make their own data collection efforts easier. Again, near-term self-interest has so far triumphed over society’s long-term best interests.

And of course there’s also the fact that there have probably always been US-friendly backdoors in Cisco kit, as this report from the FT the other day suggests.


Sajit Javid and the ‘quiet hegemon‘ he’s clearly never heard about

Javid, who is currently Chancellor of the Exchequer, was grandstanding the other week about how the liberated UK would break free of EU red tape. In an interview with the Financial Times he warned UK manufacturers that “there will not be alignment” with the EU after Brexit and insisted that firms must “adjust” to new regulations.

Not surprisingly, this caused alarm in many business sectors whose prosperity depends on adhering to EU regulations. And so Javid — possibly under instruction from Number 10 — started to row back, saying that the government will only use the freedom to diverge if it thinks the change is worthwhile, and after the pros and cons have weighed up.

The Chancellor has form in shooting his mouth off. I remember that he spoke at the launch of the previous government’s White Paper on online harms. He was then Home Secretary (aka Minister of the Interior) and his speech was less about online harms and more about how he was the tough guy who would stamp out this kind of harm. In effect, it was part of his campaign to replace Theresa May, then on her last legs as Premier.

I viewed his Financial Times interview through the same lens. He’s like Boris Johnson during May’s tenure, perpetually in campaigning mode. There are however, some harsh realities about regulatory divergence that suggest he could be riding for a fall. Today, for example, the CEO of Volvo is reported (by the FT) as saying that certifying his company’s cars for the UK market would not be worth the cost if UK rules diverged significantly from the EU’s. The result, UK consumers would have a smaller range of Volvos to choose from. And there’s an interesting new book out — The Brussels Effect: How the European Union Rules the World by Ann Bradford, an academic study detailing how, in a world increasingly driven by standards, EU standards have quietly become global standards. (Think GDPR.)

In that way, the EU has become a “quiet hegemon” of which it seems the Westminster bubble is blissfully unaware.

Hong Kong: only two possible end-games

Roger Cohen, in today’s NYT:

The most significant, perhaps the only, foreign policy achievement of the Trump administration has been to get behind the Hong Kong protesters while pressuring Xi on trade and keeping channels open to the Chinese leader. This American pressure, which has made Trump popular in Hong Kong, must not relent.

Mike Bloomberg, who has said Xi “is not a dictator,” and Joe Biden, who has said China “is not competition for us,” should take another look. Universal suffrage for Hong Kong is the only endgame I can see to the “one country, two systems” impasse, short of the People’s Liberation Army marching into the city and all hell breaking loose.

China’s abuse of human rights is possibly the only thing that the fractured US Congress agrees about. And Trump reluctantly signed the Bill.

Back to the future

The FTC is suing Qualcomm, the chip maker, in the first major monopoly case since the Microsoft one all those years ago. In his weekly newsletter, Matt Stoller provides a useful historical comparison to put the case in its context:

Qualcomm is a very important corporation, but one you may not have heard of because it doesn’t do consumer oriented work. The company makes critical components for cell phones, the stuff you don’t see but that goes into the guts of telecom systems. Its technology connects phones to cell networks, and it makes its money by selling chips and by licensing its patents to device makers.

The story of how Qualcomm monopolizes is pretty simple. The corporation does what Bill Gates did to computer manufacturers and what John D. Rockefeller did to railroads, as I wrote a few weeks ago. Rockefeller’s oil was critical to railroads, and Gates’s operating system software was critical to computer makers. Both of them thus forced their dependents to give them a fee not just for every Rockefeller barrel of oil or Microsoft OS license, but a fee for every one of their competitors’ as well. They taxed their competition and made it impossible to compete.

Qualcomm does this as well. As its competitor Intel explained, Qualcomm “refuses to sell [phone makers] any chipsets unless those manufacturers also purchase separate patent licenses that require them to pay exorbitant royalties for every handset they sell, regardless of whether the handset contains a Qualcomm chipset.” In other words, it’s the Gates/Rockefeller playbook. Find an essential chokehold, and use it to control the industry.

Qualcomm uses a few other anti-competitive tactics. It refused to license its patents – essentially standard and necessary for the industry – to competitors. And it cut exclusive deal arrangements with customers to box anyone else out of the market. (You can read the rest of Intel’s amicus brief if you want to hear expensive lawyers accurately whine about being treated unfairly.)

The strange thing is, though, that important sectors of the US government are trying to intervene in the case, effectively opposing the FTC. Their argument is that the suit undermines national security.

The DOJ argument is basically saying, yeah, Qualcomm does all that stuff, but Judge Gorsuch said it’s all legal and efficient, and we don’t want to dissuade the liberty to abuse patents and market power. Two other officials, one at the Department of Defense and another at the Department of Energy, also weighed in. Ellen Lord, a former defense contractor and the Under Secretary of Defense for Acquisition and Sustainment for the DOD, argued that Qualcomm’s position as a monopolist enables it to support national security and help China. A Department of Energy official Max Everett basically said the same thing.

The national security argument is BS, says Stoller, but not for the reason you’d think. He quotes an excerpt from a WSJ OpEd by Michael Chertoff, a former senior Cabinet officer in previous US administrations.

In the technology race against China, the U.S. should prefer to let competition drive innovation rather than support exclusive national champions. Apart from the economic inefficiency, a single-source national champion creates an unacceptable risk to American security—artificially concentrating vulnerability in a single point. The government’s argument in support of Qualcomm isn’t prudent, and if courts accept it, the result would be a self-inflicted wound to U.S. national interests. We need competition and multiple providers, not a potentially vulnerable technological monoculture.

Underpinning this argument is a prevailing denialism about China in the American Deep State. What happens, Stoller says, is that China either hacks US corporations to steal their intellectual property, or acquires it legally when they try to do business in China. So: China innovates at speed by topping up its own (substantial) native ingenuity with the ideas and wisdom of its US competitors, while those same competitors are locked out by monopolisation and patent restrictions from exploiting that same, locally-developed intellectual property in their own country.

End result: China races ahead. Madness on stilts.

Global risks 2035 update

From the Atlantic Council. Headlines are:

  • The unipolar world of the 1990s, when the United States was the world’s sole superpower, is definitively over and will no longer be a realistic option for any president.
  • An absolute United States’ decline is not inevitable, but an open conflict with China increases those risks considerably.
  • A deep economic reversal in China could trigger a widespread economic meltdown that leads to a worst-case scenario of slower growth and a return to protectionism and political destabilization.

No real surprises, really.

Full report (pdf) here