Hacker News Reader

Comment by ajross | Hacker News Reader

The spin on this situation is dumb. What it amounts to is that KPN hired Huawei on a contract basis to administer its equipment, and as a result those contract administrators had... administrator privileges on the Huawei equipment. Now, obviously telco equipment can be used for spying, but there's absolutely no allegation of wrongdoing here at all.

If there is any finger to point, it's at KPN for hiring an untrusted contractor and giving them sensitive access.

View on HN

> Now, obviously telco equipment can be used for spying, but there's absolutely no allegation of wrongdoing here at all.

That's incorrect. The report made by Capgemini stated that there were clear boundaries as to what Huawei was allowed to access but they violated those boundaries. Apparently also a list of numbers under surveillance by Dutch intelligence was found in possession of Huawei. Which was clearly well beyond those boundaries.

Just like a sysadmin can read the mail of the boss doesn't mean your allowed to.

Though I can't read the actual report, this article does not support your claims.

>Apparently also a list of numbers under surveillance by Dutch intelligence was found in possession of Huawei. Which was clearly well beyond those boundaries

Wouldn't the ones running the network need to know which numbers were under surveillance to provide the intelligence agency access?

The original source[0] definitely supports those claims.

"Ongecontroleerde en ongeautoriseerde toegang vanuit China heeft na 28 oktober 2009 daadwerkelijk plaatsgevonden"

which translates to

"Uncontrolled and unauthorized access from China actually took place after October 28, 2009"

> Wouldn't the ones running the network need to know which numbers were under surveillance to provide the intelligence agency access?

No. That data should only be on a server within the KPN network. Huawei employees had an office in a KPN building. There is no need for that data to ever leave that network.

[0]: https://www.volkskrant.nl/nieuws-achtergrond/huawei-kon-alle...

>Uncontrolled and unauthorized access from China actually took place after October 28, 2009"

That does not state Huawei is responsible for that event, it could be the security testing team.

I work at a company that has a sister entity in China. We routinely have to defend against their deliberate, concerted efforts to breach the various firewalls we've erected to keep the networks separate. These are almost always billed as "security scans"--but there's no good reason for them.

We're discussing a report from a team hired to do a security audit, that would certainly qualify as a good reason for them.

Depends on the scope and intent. If they're anything like our China partner, the scope is far outside the contract and the intent is pretty clearly nefarious. They act like we're too stupid to understand or recognize what they're doing, too.

Hackers could always claim they were security testing :)

If that would have been the case, it would have been the first thing they'd mention though.

It was? Those words came from the report done by the security testing team.

Copy the lines + link that state that please. That's not my observation.

Note: i'm a native dutch speaker. So no translation required.

From the original link

>The Capgemini report stated that Huawei staff, both from within KPN buildings and from China, could eavesdrop on unauthorized, uncontrolled, and unlimited KPN mobile numbers.

That quote clearly comes from the security testing team's report. It's not clear from the quote provided to me who is responsible for the "Uncontrolled and unauthorized access," but we know there was an ongoing security audit at the time mentioned.

Capgemini did the audit, not Huawei who had uncontrolled access.

It should be clear that unauthorized access is not from those doing the audit, but from Huawei. Why is that so hard to understand? Lol

Why should it be clear? What evidence do you have? I can't read the report, you could easily find where they say "Huawei was responsible for the unauthorized access" that for some reason the articles don't directly quote.

Instead you're acting like I'm being dumb for not making baseless assumptions. The articles aren't titled "Huawei eavesdropped on KPN" for a reason.

Unauthorized access was detected from China outside of the procedure.

With that access they could have done anything ( eg. eavesdropping ).

Follow up requests are currently happening by the Dutch government ( other related news from today).

KPN also mentioned: currently they have no access. While the report states: they had access.

KPN mentioned that Huawei's employees with access were employed by KPN. Wick could be correct, but it didn't explain access from China since those employees are employed in the netherlands.

A bit of wordplay going around. That's true.

Capgemini:

Huawei blijkt zich buiten de procedure om vanuit China toegang tot de kern van het netwerk te verschaffen. Veiligheidsmensen van KPN weten dat dit gebeurt, maar doen niets. ‘Ongecontroleerde en ongeautoriseerde toegang vanuit China heeft na 28 oktober 2009 daadwerkelijk plaatsgevonden’, vermeldt het rapport in april 2010. [...] De onderzoekers [van Capgemini] vragen het Chinese bedrijf daarom wie bij de gegevens kan en hoe de versleuteling is geregeld. ‘Pas na lang aandringen’ is Huawei bereid ‘duidelijkheid te verschaffen’. Huawei blijkt een uiterst zwakke versleuteling toe te passen en zelf het sleutelbeheer te doen. Capgemini: ‘Daarmee zijn nummers die onder de tap staan bekend bij Huawei’.

Edit: couldn't respond below. Source is the origin of all foreign news articles, it's the original newspaper that is in possession of the Capgemini report: https://www.volkskrant.nl/nieuws-achtergrond/huawei-kon-alle...

( Google cache is possible as a workaround fyi)

Where is this Capgemeni statement from? It's extremely strange that they make several accusations yet the only part that's actually from the report is the same quote mentioned before. The [...] also moves on to a completely new topic.

Overall, it says the same "Huawei could have done something" as the other sources I've seen.

The article says:

> The company gained unauthorized access to the heart of the mobile network from China.

... but then, in the very next sentence:

> How often that happened is not clear because it was not recorded anywhere.

This wording is a bit unclear. The first sentence states as a matter of fact that there was unauthorized access, while the second states that there are no records.

I read it as meaning they had access (i.e. they could access it), but we don't know if they did access it.

You'd be better advised to read it as: journalists have no idea what they're describing, and mash together words without nuanced regard to what the facts may be.

c.f. the Murray Gell-Mann Amnesia Effect.

"The company" could refer to either Huawei or Capgemeni in that sentence, and Capgemeni makes the most sense given the following sentence.

That is not conflicting. "did they" and "how often" are two different questions. Metadata can and often does indicate the fact that something was accessed but not how often. For example, the "last modified" user/timestamp on a file.

It might mean not officially recorded anywhere, like an intelligence agency gave them a heads up about it, but the network admins at the company didn't see anything with their monitoring software.

Or the admins saw it once and then revoked privileges - you know it happened at least once and probably more, but you don't know how many more.

It could be done at arms length through an API. Then it would become an issue of reading data they shouldn’t be.

Wouldn't that API then just give someone else (presumably the intelligence agency) unrestrained access to all phone lines? Someone outside should be responsible for providing access, you can argue Huawei shouldn't have been chosen but I find it hard to blame them for doing their job.

Unless people inventing such API thought that the domestic telco equipment will be operated by foregin companies. And I somehow suspect they've thought exactly the opposite: that they can rely on domestic providers be domestic firms, easily supervised by the domestic law enforcement agencies.

Could also be possession of database with intent to select.

I feel we need to read all these stories with a skeptical eye because, frankly, Huawei's become a political football, and there is a very strong motivation to cast events in the most unfavorable light possible by officials who are working backwards from the conclusion. Perhaps they do have some kind of spying master plan but I have found a lot of the fanfare for these stories hasn't held up to scrutiny.

I agree that there is a lot of spin on these stories: efforts to paint bad and sloppy network security decisions as evidence of actual malice. I am sympathetic to the national security agencies who are likely driving this reporting, though. Giving untrusted foreign companies access to your communications infrastructure is generally a bad idea, and the evidence (from Western countries’ own actions) is that this kind of access will eventually be abused. But the problem is that there appears to be an effort to paint these security screwups as something more concretely malicious than they are, in order to sway public opinion.

From my perspective it does not make a lot of sense for Huawei or China to engage in overt spying at this stage of the game, even if (assuming the worst intentions) that is something they plan to do. Right now all of the incentives for that company are to gain the trust of customers during these early stages when everyone is looking for a reason to throw up protectionist barriers. A decade from now when Huawei systems are ubiquitous and the competition has largely been put out of business, then maybe the situation will be different. But why kill the golden goose by doing something stupid now?

That doesn’t mean there wasn’t bad behavior. Maybe people are behaving irrationally. But I tend to see sloppiness behind these stories rather than actual malice.

> Right now all of the incentives for that company are to gain the trust of customers during these early stages when everyone is looking for a reason to throw up protectionist barriers.

What makes you think these are "early stages"? AFAIK many telcos already use Huawei 4G equipment, though I can't find actual numbers for that. I'd say Huawei/China is already well positioned to abuse any backdoor access they have. The move to 5G could only expand this.

KPN is obviously in the wrong here since they can't prove whether there was unauthorized access or not, and speculation articles like this don't help. In any case, it doesn't seem like a good idea to give untethered access to a company accused of IP theft time and time again[1]. Whether all those are PR smear campaigns or there's a real cause for concern is difficult to judge as an outsider, but given China's track record, I'm inclined to believe there's some truth in them.

[1]: https://www.forbes.com/sites/zakdoffman/2019/05/25/huawei-ac...

>What makes you think these are "early stages"? AFAIK many telcos already use Huawei 4G equipment, though I can't find actual numbers for that. I'd say Huawei/China is already well positioned to abuse any backdoor access they have. The move to 5G could only expand this.

We're at the peak of a massive international debate regarding the role of Huawei in Western communications networks. This is a debate that has already led to bans and restrictions on the deployment of Huawei equipment in 5G networks [0-3]. 5G buildouts are happening right now, and hence the political purchasing decisions (with a multi-decade impact) are happening now. I suspect that's why we're seeing things like TFA.

It seems to me that this would be the worst possible time for Huawei to get caught doing something unambiguously malicious. Right now Western networks could remove Huawei if they wanted to, or if politicians ban it. Ten years from now -- assuming Huawei "wins" in most Western nations -- it will be vastly more difficult to replace that equipment. If we imagine a 2035 where Huawei has dominated the US/European 5G market, I suspect that their European competitors will also be much weaker (or will have abandoned the field entirely), meaning that there really isn't much of an alternative.

So TL;DR I can't say that there is a good time to get caught spying, but there definitely is a bad time: and it's right now.

[0] https://www.bbc.com/news/newsbeat-47041341 [1] https://www.telecompaper.com/news/dutch-mps-call-for-more-cl... [2] https://www.reuters.com/article/us-france-huawei-5g-security... [3-N] Just search on "<European country> 5g Huawei debate"

Part of what made the US hit the panic button was that Huawei was poised to be the premier maker of 5G equipment all over the world.

This is something that irks me as well. Every time Huawei is mentioned in a conversation, the topic of spying is inevitably brought up, but as far as I know there has been no concrete case found that they did indeed do any kind of spying act through their equipment. If someone can actually link me something that can prove this claim I would be very interested to read it.

Reminds me a bit of the Bloomberg saga also, where theoretical compromises were somehow "confused" for real ones when a journalist talked to a spook: https://9to5mac.com/2021/02/15/bloomberg-spy-chip-2/

Understand that feeling but Huaweis existence is born from corporate espionage stealing IP from Nortel networks in the 00s. Not a great starting point for a company and it really doesn’t take much of a stretch to see the concern about Chinese party wanting to spy on the rest of the world given the lack of freedom of their own people...

That's just not true. Nortel collapsed due to its own terrible management, including a massive accounting scandal. Years later, a former Nortel exec tried to pin the blame on Chinese hackers.

Nortel collapse has many reasons that I am not debating. The stealing of IP and then undercutting the bids of Nortel with the same tech but cheaper is where Huawei got their break. My point is if thats a starting point as a company what kind of culture is breed from it and what does that say about the current situation

> The stealing of IP and then undercutting the bids of Nortel with the same tech but cheaper is where Huawei got their break.

There are a lot of unsubstantiated claims here. First of all, the stealing of IP. Next, that this is how Huawei got their break.

As far as I understand it, Huawei grew by developing cheap telephone switches in the 1980s and early 1990s, long before it had anything to do with Nortel. Huawei focused on relatively simple components that it could manufacture more cheaply than Western competitors, and it gained market share inside China. It only moved up the value chain as its revenue increased and it had more ability to spend on R&D. By the time Huawei was beginning to move into more advanced markets, Nortel was already a basket case.

The strange thing to me is that all these claims that Huawei made it because they supposedly stole from Nortel seem to have appeared in the 2010s, long after Nortel's demise, and they're incredibly vague. By contrast, analyses of Huawei's early history that I've seen barely mention Nortel: [1].

1. https://csis-website-prod.s3.amazonaws.com/s3fs-public/legac...

I think this article sums it up effectively. Economic espionage on the behalf of state funding the company and corporate espionage state sponsored hacking of Nortel from 2000 to 2009 and then hiring 20 scientists from Nortel. My argument isn't about Nortel its about the behavior of Huawei and why it isn't a trusted company.

https://www.bnnbloomberg.ca/did-a-chinese-hack-kill-canada-s...

Poaching employees from a competitor is not economic espionage. It's extremely common.

And then here's the key line:

> No one knows who managed to hack Nortel or where that data went in China.

This is all so vague, whereas the reasons for Huawei's growth and Nortel's demise are so much more concrete. For Huawei, the ability to capture a sizeable chunk of the market in China for cheap telephone switches, aided by its lower labor costs, better knowledge of the local market, and some level of protectionism. For Nortel, serious mismanagement and a financial scandal.

The thesis of the article, that economic espionage in the 2000s did in Nortel, is not plausible. It just looks like blame-shifting from a former Nortel employee, which Bloomberg decided to trumpet during a time (2000) when the US government was waging was a major anti-Huawei campaign.

Probably all of our point are true to a point and all contribute. Again I’m not arguing about nortels downfall (which you seem to be focused on maybe because that is a lot easier to discuss than huaweis trustworthiness), I’m pointing to why Huawei is not a trusted company. If you can convince me of it’s trustworthiness please do - otherwise I will rely on the multiple sources of material that seem to point to its connections to the Chinese government.

And yes most state sponsored hacks are difficult to figure out exactly the source and end use of the data. Look at what’s happening right now with the solar winds back for instance.

> otherwise I will rely on the multiple sources of material that seem to point to its connections to the Chinese government

Is the expectation that businesses are supposed to simply ignore the authority of the sovereign states they operate in? There seems to be a bit of circular logic going on here.

Agreed. You’ve proven my point. The trustworthiness of Huawei is interwoven with their government which has proven to be untrustworthy and one which I wouldn’t want to build critical intelligence infrastructure upon.

> it really doesn’t take much of a stretch to see the concern about Chinese party wanting to spy on the rest of the world given the lack of freedom of their own people

Perhaps not, but I try not to believe things just because they confirm my existing biases.

I agree - it is a dangerous precedent to set. I do think that with large infrastructure purchases and installations you really have to go in with open eyes -- it's very difficult to undo those kind of purchases. Probably make sense to use trusted providers.

> for hiring an untrusted contractor

So you agree Huawei cannot be trusted. I think that is the whole point of the discussion.

Not OP, but must probably this is just part of the anti-China propaganda , I think it started with the false accusations from Bloomberg... so I expect that any Huawei related news is false until some actual evidence is presented to the police or something.

Huawei doesn't really deserve the benefit of the doubt, a lot of their early success was due to hacking Cisco and Nortel then building competing products based on stolen information, all while the Chinese government was restricting non-Chinese telecom vendors from operating in the country.

I personally don't like to be manipulated by media. So for this case I am just saying be aware not to be a tool/pawn is some big player's game, I suggest you either do more digging , wait for some real evidence - but downvote if the mention of the Bloomberg fake article or innocent until proven guilty is a something wrong that needs to be hidden.

You're contradicting yourself here, as you don't want to be manipulated but are already convinced that this is part of anti-China propaganda.

Also, innocent until proven guilty should only apply to regular people, not state actors. Many historical events are only declassified after 50, 60 years, or never at all. Believe a story or not is your judgement, but asking for proofs are either naive, or just looking for excuses.

I mean the title and the content do not match . So the title was created to push a certain agenda , so what? is it propaganda or just the old pure evil capitalism that pushed the editor to change the title into some false accusations?

I did not said that Huawei is not spying, mayb ethey do but I am still waiting for the evidence. Similar on how I wait for evidence that Google is reading our politicians emails and blackmailing them - is not enough to hear some conspiracy and then upvote it like a tool because I hate Huawei or Google.

You shouldn't trust any provider under the jurisdiction of an anti-liberty nation-state: https://en.wikipedia.org/wiki/Room_641A

Not sure why Huawei is unique here.

The US and the Netherlands are both allied members of NATO. That's why Huawei is a different story.

Are you saying it's worse for China to (be granted sufficient access by the Netherlands that, in theory, if they wished to abuse that access, they could) spy on communications in the Netherlands than for the US to spy on communications in the US?

I'm saying that the it's a reductionist oversimplification to say that it doesn't matter who the Netherlands picks for their telecom infrastructure because "everyone spies". Different countries have different relationships with each other, and the entire point of an alliance is to cooperate and establish trust.

From a NATO point of view yes. China spying on the Netherlands would be worse than the US spying on itself.

I can't speak for the OP, but I'd say that, yes. The US's spying activity is an overreach (to put it mildly) and I don't agree with the extent or purpose in many cases. We also don't really have a well functioning democracy, in my opinion, due to the capture of the government by private corporations. But what we do have is still a democracy, and it is absolutely lightyears above and beyond the genocidal, anti-liberty government of China.

And that's pretty much the situation of every telecom in europe and probably many more countries https://berthub.eu/articles/posts/5g-elephant-in-the-room/

Even if they are at fault for not doing their due diligence that doesn't remove the fault of someone spying

What's upsetting is that these organizations are given exclusive use of something that is essentially public (certain electronic sounds in the air) and they were very careless with it. It has nothing to do with Huawei and everything to do with KPN (and most other telcos) being negligent.

> Now, obviously telco equipment can be used for spying, but there's absolutely no allegation of wrongdoing here at all.

Of course. But, security posture is an important thing to consider. This may be an obvious thing to many people on this forum, but it is not obvious to much of the general public.

Well, what you just read is a counter-propaganda piece, so that’s no surprise that it was spun that way.

That's not what it's saying ( i speak dutch)

First of all, it's not a spinoff. KPN his the report because it was afraid for it's existence.

Second is that Huawei could listen to KPN'S internal communications ( = their network) that includes a lot of government calls.

> untrusted contractor

As far as I'm aware, practically every European telco hires Huawei engineers to maintain their infrastructure in this way. It's therefore not reasonable to call them an untrusted contractor, as they are evidently very trusted.

it is a very big deal since none of these people are LEO's:

"Huawei also knew which numbers were tapped by police and intelligence services."

massive boon to the CCP IC to have access on a foreign's country ongoing investigation etc. (the in Canada detained CFO comes to mind but the potential is much bigger than this)

Your comment sound kind of like victim blaming.

If there was no actual spying, then there's no victim.

If someone gets pickpocketed on the subway, saying "You should have protected yourself better" is victim blaming, sure. But if someone doesn't get pickpocketed and then points out how there was a foreigner sitting right next to them who could, theoretically, have pickpocketed them, should they have chosen, and while the foreigner didn't pickpocket them this time, you know how those foreigners are... then "Why didn't you just get up and sit somewhere else if he bothered you" is a particularly polite form of what you perhaps ought to tell them.

Reply on news.ycombinator.com