Lithuania says throw away Chinese phones due to censorship concerns

So, what are the other entries, and why were they redacted out?

Is it me or is this an extremely clumsy way of doing censorship?

Why not do this at network or server-side level? Why not use some kind of hash (ala Apple'e proposed child pornography hunter)?

In this design, everyone would have to have this plain text configuration file ... also other brands (Oppo, Huawei etc.) would have to have it. What if it needs an update? Suppose the hui muslims starts causing trouble ... Or if people starts using slang or deliberate misspelling ...

This is pretty clearly a low-effort filter for advertisements deemed political.

> 204 "人民报", “People’s daily newspaper”

People's Daily is an official Communist Party newspaper... Why on earth would they blocklist that if this is a politically-motivated censorship program (as the paper/many here are implying)?

Similar lists existed within Google for their ("on hold" last I heard) project Dragonfly [0]. I saw a bunch of banned terms like these in the Dragonfly repo before they hid it from regular employees. It was a very long list. On it were also the names of specific activists and human rights lawyers, including some who'd been disappeared [1] or forcibly confined to mental institutions [2].

My impression is that Sundar was all-in on Dragonfly, and he only rolled it back because of tremendous external and internal pressure. As that pressure abates over time, expect Dragonfly to return. Word of warning for those who trust Google as a defender of digital privacy and human rights.

[0] https://en.wikipedia.org/wiki/Dragonfly_(search_engine)

[1] https://www.theguardian.com/world/2016/dec/06/un-human-right...

[2] https://finance.yahoo.com/news/chinas-ink-girl-defaced-xi-09...

i'm surprised that Taiwan is not on the list.

I have a Xiaomi device and can confirm the API request. It does this regardless of country, including in GDPR countries. It makes multiple requests like this per minute. And if you click on the Privacy Policy in the Xiaomi Smart Home app for instance, it shows a 404 error.

What about Android One?

Not to sound paranoid, but won't even LinageOS phones have to run closed-sourced firmware and drivers?

You can replace the user-facing software, but can/would you trust the baseband?

I was stupid enough to buy a Xiaomi phone without enough due diligence. Aside from all spying that is going on, the software is abysmal.

The problem with replacing the OS is that I believe most banking apps I use will stop working. Might just need to write this phone off.

Most people don't care if another country spies on them, since their laws don't apply to them. They would care much more if they are profiled by their own government. Or more like tech companies on behalf of the government spying on them, and them being discriminated, harassed, or jailed based on that data. So in a way its actually kind of smart to go with a Chinese phone if you live in America.

Good value assuming you're on the right carrier. AT&T in the US and its MVNOs are moving to a whitelist model in February, making Xiaomi phones unusable for anyone in the US not on T-Mobile.

On a related note, Realme recently bricked two (maybe more) phone models with an update that caused a soft-boot loop if the weather service (!) was removed by the user to reduce bloat. The problem is not fixed. People have lost data. I personally put Realme on my "never do business with" list.

If their engineering is so poor that they haven't caught this in time, nor reacted by releasing a one-line software patch that can be applied manually (cause users sure as hell can't do it themselves - stock can only apply signed updates), they shouldn't be trusted with anything.

Off the top of my head, theu can censor at the keyboard level, at the SMS level, and at the camera level: https://www.reddit.com/r/Xiaomi/comments/pgk8y3/xiaomi_camer...

Android hacker community, like XDA, should be able to quickly reserve engineer this as more details surface

Maybe they just turn offenders along with the evidence over the the PLA, for "review."

I used the tweet due to the paywall of the Reuters article.

Another user below found the best link, the true original source:

Here's the official report: https://www.nksc.lt/doc/en/analysis/2021-08-23_5G-CN-analysi... (link updated)

Wow thanks for all that you do and blogging about this.

HN discussion here: https://news.ycombinator.com/item?id=28499918

This is what kinda terrifies me about today's digital landscape. Now it's so cheap to hide surveillance capabilities (spyware, hidden microphones or cameras) that bad actors can just embed surveillance into every cheap device, hoping just by sheer numbers to get one into a sensitive area (e.g. Pentagon, Langley), and then remotely activate surveillance. With the computational capabilities of today's data centers, they don't even have to be all that selective anymore. They could just be monitoring everyone, at some granularity, dumping logs into a massive database with just enough metadata to make it searchable/queryable.

It's downright dystopian.

Is that even enough though? Couldn't china put in shadow processors or other hardware-level surveillance similar to Intel's management engine? And it would be extremely difficult to detect, let alone disable or mitigate.

Android 7? Then you don't need malware. It will be provided on first boot by multiple parties.

Mongolia needs allies to withstand China's looming threat https://asia.nikkei.com/Opinion/Mongolia-needs-allies-to-wit...

The implications of the rise of China's military for Mongolian security https://calhoun.nps.edu/handle/10945/5340

China accused of 'cultural genocide' in Inner Mongolia https://www.ucanews.com/news/china-accused-of-cultural-genoc...

China’s Crackdown on Mongolian Culture https://thediplomat.com/2020/09/chinas-crackdown-on-mongolia...

"People's Daily newspaper" is a pretty big counterexample that everyone is conveniently ignoring.

China absolutely has designs on Mongolia. The whole existence of the modern Mongolian state is a mess of cold-war / world war 2 geopolitical compromises that left basically no one happy. If Sino-Russian relations cool, or the climate of Mongolia itself warms, it could quickly find itself in an awkward spot between two notoriously bad-faith superpowers and with essentially no alternatives to vassalage.

The issue of Mongolian independence was left ambiguous by the USSR and China (this includes the PRC and ROC -- they both technically claim it). Mongolia had at one point petitioned to join the USSR but was actually rejected. The status of Mongolia was a bargaining chip the USSR used with the PRC and China never really completely relinquished its claim on it (whether that claim is legit is another issue)

Good YouTube overview: https://www.youtube.com/watch?v=NUa1mvaYNtk

There is the inner Mongolia autonomous region which is part of the PRC.

Independence of Mongolia maybe talking about "Inner Mongolia," which has ten times as many people as the country of Mongolia. My guess with the Palestine piece is the "Muslim terrorists" in Xinjiang would be interested in that.

Independence of Mongolia refers to Inner Mongolia, a Chinese region with a low ethnic Han population. It and the country of Mongolia serve as buffers against the Russians.

The Independence of Mongolia is probably about Inner Mongolia, which is part of China. You can read some history about how Mongolia became independent. The official map of ROC (Republic of China) does not officially recognize Mongolia. The PRC (CCP) recognized the independence of Mongolia. Probably people in Mongolia think Inner Mongolia in China should be part of their territory, and there is an organization for that.

China is pro Palestine if you follow the news. The relationship between Palestine and China goes back to 80s.

I don't think Xiaomi cares what people in Lithuania are reading, other than selling its phones. I don't think CCP cares about what people in Lithuania are reading.

As far as I can tell, the meta solution here is open source hardware and software. Otherwise it just doesn't matter who is doing this, why they do it, or who is affected.

The core issue is the lack of end to end encryption and open source hardware and software. Options today are okay, but they need to be great to reach the right people. See my post in this thread about Pinephone and Librem.

Network isn’t even the only egress route out of a cellphone. They have sophisticated radios, so a low-level (e.g. on-silicon) backdoor could send your data out to a nearby agent using all manner of electro-magnetic emissions.

You just have to trust the manufacturer and its supply chain, and that applies to open source too.

"made" in this case tends to refer to created, not just manufactured. it (as the article states) is mostly an issue for chinese brands with poor quality control or ulterior motives.

Presumably Apple ensures there is nothing nefarious in the hardware, but it seems an unlikely avenue for compromise. Most of the "phone" is Apple-provided software.

In theory sure, you could have a chip snooping on the bus. But it would have to have a lot of OS-level knowledge and then how would it exfiltrate the data without OS-level access to the IP stack?

Like the Bloomberg/Supermicro story, I am extremely skeptical.

A Chinese-built phone that comes supplied with an OS, that's a totally different matter.

Just a nit because you’re mostly right, but Foxconn is a Taiwanese company that does its manufacturing in China.

Foxconn is not Chinese, it's a Taiwanese contract manufacturer, that does have most factories in China (but it also has factories in other countries). The reason why Foxconn is so successful is because they do a good job in quality control and honoring contracts, which sets them apart. They are trying to blend Western-style rule of law with Chinese wages and infrastructure.

The successful stories about western companies outsourcing to China do tend to fall into the category of building and running your own factory there, rather than contracting with a Chinese owned and managed factory to produce to spec, which suffers from all the ethical problems discussed in the parent post. E.g. these are all decisions taken by management, not individual factory workers, so if you want to reduce risk, then install your own management.

I think the whole discussion is missing the mark, so much so that I personally tend to believe that is the point. Your electronics spies on you, that's just how it is. The important question is if the data gathered could possibly hurt you now or in the future. We can only speculate on what thoughts and opinions become dangerous in the future. So with that said I would look at the problem from the perspective of "can this hurtful data be accessed by someone with reach to reach me". All the way from targeted advertisements to someone kicking in your door. That only leaves one answer as far as I can tell: Chinese phones are safer for everyone not inside China or maybe in one or two other countries. Using US electronics or software on the other hand and you can be reached in pretty much all the countries left out above.

>> This implies that Xiaomi, and most likely all Chinese phone vendors and by extension CCP, has backdoors in all these devices.

They don't need backdoors. They are the "administrator" of your phone just like Apple is on iOS and MacOS or Microsoft on Windows boxes.You are just a guest.

It just happens that the chinese admins(aka vendors) don't mind being nasty and clumsy at the same time. All the manufacturers/vendors are controlled by their government(more or less).

That being said I don't buy chinese phones or software unless I have no choice but I don't trust Apple to shield my data from various governments either. It's just a matter of lesser evil.

But they didn't find anything in Huawei's device or oneplus device. That shows this is not a marching order from the ccp or government to export censorship abroad. If so, then all products with Chinese origin should all have them. What is likely happened here is that xiaomi included code they needed to comply with laws in china in products for aboard, but it is deactivated for in any region other than mainland china. They should have removed the code completely, either have different software builds or don't do anything on the client side to comply with laws in china. Apple complies with Chinese laws fine and I doubt they had to implement any client side changes.

I doubt xiaomi and other Chinese company dares to enable censorship anywhere in international markets, or have a secret plan to control world's information discourse to support ccp. Any censorship or apparent support of ccp will be caught within seconds. Its commercial and political suicide. Also if they do have a secret plan, just blacking out whatever people are typing on their phones is such a dumb, stupid, and crude way of implementing censorship.

Also, this report found no censorship mechanisms on huawei and oneplus phones. Yet they said people should ditch all Chinese phones, which implies all phones originated from Chinese origin companies have censorship mechanisms. That is a much larger conclusion than what the evidence they provided, seem like a politically motivated desire to discredit and defame all Chinese origin companies and products.

I also doubt ccp has a marching order for Chinese companies to censor speech internationally and manipulate world's information discourse. Chinese phones have big market share already, and huawei's gear has wide market share in Europe, but no one ever experienced censorship on their device for speaking against China. And if there is a secret plan to control world's information, they are doing a terrible job at it. The covid origins, xinjiang Uyghurs, Hongkong. The point of view of Chinese side is non existent. For example the xinjiang Uyghur situation, I know people in xinjiang, many of whom are uyghur people, the accusation of mass genocide, 1 million imprisonment, wide spread physical abuse and rapes in prisons, massive internment camps with forced labor is wildly inaccurate from the truth. Yet, it hasn't stopped this from becoming the wildly believed truth, to the point where if you disagree with these statements, you are a ccp shill, a genocide sympathizer and brainwashed. For me and a lot of mainland Chinese people I know, we feel our voices and our personal real life experiences are being censored by international media and public discourse. Sometimes I read something about China in the international discourse, it feels its talking about an alternative universe than my real life experience. I have to wonder who is really controlling the narrative, censoring speech and pushing their political agenda.

Yes the context is Lithuania dared state the obvious fact that Taiwan is a country, and now they are paying the price.

You can read the report and literally look up file on your Xiaomi phone which contains censored words.

> which suggests to me that they could update it to match any terms in any language if they wanted.

About the same thing as Apple scanning iPhones for what they say is child porn.

suggests to me they could update it to match any images if they wanted...

The thing is if these censorship is enabled, its going to be found out in a second by someone and explode in the news. All it does is that it deletes a word you typed on your phone or prevent you from seeing a piece of content that you want to see. It's going to be so obvious. It will not achieve the desired goal to censor in the first place and will make people realize what you don't want people to see. It will completely backfire. Given it is a broken and illogical plan, then it is highly unlikely there is a a multi year effort to build phones, sale to international markets, just to censor what people want to say and feed people about ccp propaganda. Even if someone is so stupid and want to do it anyway. What you fear is the censorship actually work. But you don't have to worry about that as it will not work.

That would be my interpretation as well - these non mangled names I guess they come from an api.

I am curious about this too.

From what I can gather from the report it should be possible to reproduce the analysis. Probably it is even possible to run the apps in question in an emulator.

Also it should be possible to get the full url of the censorship configuation file and also its full contents.

Given the extreme politics around this, I think it would be better if this type of analysis was done as open source and in a completely reproducible manner.

New Pixel ?

iPhone?

Just buy Pixel phones, the pure Android experience and day 1 updates are worth it. The new Pixel 6 will use LTS kernel and custom SoC, rumored to have updates for 5 years instead of what was a standard of 3.

Pixel with GrapheneOS

If you care about privacy one of the few options is a Google Pixel with CalyxOS and no Google Services.

Not Android, but made in the USA: https://puri.sm/products/librem-5-usa (and can run Waydroid).

Pixel 5a. Made in Vietnam by the Taiwanese company Compal Electronics https://tw.appledaily.com/property/20210819/4W5C3MGDDJEILMIY...

Not Pixel 6 though. Still made in China https://asia.nikkei.com/Business/China-tech/COVID-slows-Appl...

Consider the Gigaset GS4 or one of their older devices. The GS4 is not currently rooted afaik but some of their older devices (GS290?) are supported by (edit)e.foundation [1] and etc. As an additional benefit, they are made in Germany (though the origin of the parts is probably not exclusively German I guess.)

[1] https://doc.e.foundation/devices

Xiaomi devices are not and never were certified for use in Canada.

It seems like the keyword match is based on Chinese, based on the extract on page 23 of the report.

Linked near the top of the thread, 32 pages of goodness: https://www.nksc.lt/doc/en/analysis/2021-08-23_5G-CN-analysi...

Yes, Lenovo is a Chinese manufacturer

What can you send from your phone that will get you arrested by the FBI, vs what can get you arrested by Chinese forces? Is this a valid comparison?

Except your phone is not backdoored by the FBI.

Well, if you have anything on your Chinese phone (assuming it dead leak/back door back to China) that could get you arrested by the FBI - then whoever in China who had that ability to use it could then blackmail you with threats of arrest by the FBI if they told them, and you’d be in even worse shape right?

Especially since then they’d probably have you do things that would result in even more jail time if caught than the original thing. And since your data is transiting international borders all the time, it would make a nice juicy target for the NSA as well!

Interestingly, people have been trying to flee Lithuania for the US when the USSR was still around, and not the other way around.

I wonder if they might be skeptical of another communist regime starting to interfere with the country. Worked so well the last time...

The scan is not for English words. Extract from table 14.... =================================================== No.: Original - Approximate translation 1 "宗教虔信者阵线", “Front of religious believers”, ... 22 "西藏自由", “Free Tibet”, ... 60 "蒙古独立", “Independence of Mongolia”, 61 "89民运", “89 Democracy Movement”, 62 "基督灵恩布道团", “Christian charismatic mission”, ... 145 "伊斯兰联盟", “Islamic League”, ... 201 "民运", “Democratic Movement”, 202 "妇女委员会", “Women’s Committee”, 203 "伊斯兰马格里布基地组织", “Al-Qaida in the Islamic Maghreb”, 204 "人民报", “People’s daily newspaper”, 205 "巴勒斯坦解放组织", “The Organisation for the Liberation of Palestine”,

backdoored by FBI : Which phone is that?

well, for the 4 people left using a Moto, maybe??

Not trying to be a jerk, but the S in IoT comes from Security. I work in an area where IoT is the top buzzword of the past 3-4 years, I have nothing in my house and so far nothing in my work area of influence. I have a "smart" Chinese air conditioning unit with WiFi disabled and a "smart" Samsung TV with Ethernet not connected, not because I am paranoid but because I am old enough to have some life experience.

No, the OP in the thread later retracted as they could not replicate and it seemed more like a random bug in the camera:

"Yesterday I was a bit in a hurry and could not do all tests that I would have liked to. Today I tried to repeat the whole process with the same setup, documents still laying on the same table untouched etc. Just the lighting changed substantially (morning sun).

I was unable to repeat the 'green picture effect' even once... all pictures taking with Xiaomi stock camera turned out well.

I am sorry that I jumped to unproven conclusions (censoring) :( "

Please read your full source in the future before posting. It clouds the discussion. (I just did this myself on another article)

this turned out to not be true - the comments pointed out that the overwrite is likely an app interpreting it as different image format, which had happened before, and OP didn't replicate the issue the next day in different light

Thanks. I used the tweet due to the paywall of the Reuters article. But this original source is of course much better.

Thanks, there was also this discussion earlier this morning which linked there as well:

https://news.ycombinator.com/item?id=28613703

I don't think there were allegations that you couldn't type Free Tibet?

Unless you are based in China, a Chinese national, a known dissident or a journalist it doesn't really matter, does it? Also, how do you know what Xiaomi did after you typed it?

EDIT: As I really phrased it badly, I mean it doesn't proof anything if none of the above mentioned groups does it. It absolutely matters that Xiaomi is censoring and monitoring stuff based on key words. I oppose that even more than oppose Apple monitoring child pornography. Simply because Xiaomi is already doing the monitoring for a non Democratic repressive government.

According to the 32 page research report the phrase is "西藏自由", and also that blocking is disabled outside regions of interest. So it's likely you won't see anything happen, but worth a try!

Whilst the loveable bear was somewhat banned online for a little time a while ago, it's now not actually banned in China in itself and is and has been a popular children's toy. Disney stores also exist and sell winne the pooh in China.

What's more accurate is the use of the bear with reference to their leader (who looks like him!)

A better string would be "tianamen square massacre"

The 35 page report has details that should make it easy to replicate.

"This file contains a list composed of the titles, names and other information of various religious and political groups and social movements (at the time of the analysis, the MiAdBlacklistConfig file contained 449 elements). A fragment of the MiAdBlacklistConfig file is shown in Table 14." page 23

Linked elsewhere but here's the PDF report: https://www.nksc.lt/doc/en/analysis/2021-08-23_5G-CN-analysi...

There are no mass-produced US phones. Hand-made boutique Purism US-edition doesn’t count.

I know right? This post and the report it links reeks of political motive.

There were multiple articles about apple's csm with discussions.