PRC Targeting of Commercial Telecommunications Infrastructure(fbi.gov)
fbi.gov
PRC Targeting of Commercial Telecommunications Infrastructure
https://www.fbi.gov/news/press-releases/joint-statement-from-fbi-and-cisa-on-the-peoples-republic-of-china-targeting-of-commercial-telecommunications-infrastructure
156 comments
Two things and one question:
1) While being a fantastic resource to get a first impression of what's out there, the Defense Universities Tracker has not been updated since about 2019. So it is starting to be outdated and anyone using it should be well aware of it. It seems that an update is in an early stage.
2) In order to assess the actual risks, the sources that are provided at each institution's page are crucial. These are ommitted in your version. Please consider linking back to each institutions page under https://unitracker.aspi.org.au/
The question: What is the value added of your page over the official page https://unitracker.aspi.org.au/ ? I only see the map. Am I missing something?
1) While being a fantastic resource to get a first impression of what's out there, the Defense Universities Tracker has not been updated since about 2019. So it is starting to be outdated and anyone using it should be well aware of it. It seems that an update is in an early stage.
2) In order to assess the actual risks, the sources that are provided at each institution's page are crucial. These are ommitted in your version. Please consider linking back to each institutions page under https://unitracker.aspi.org.au/
The question: What is the value added of your page over the official page https://unitracker.aspi.org.au/ ? I only see the map. Am I missing something?
I’ve updated my link to include the site and wish I had searched more thoroughly as it would have saved me hours; This visualization was more of a personal thing after I stumbled upon it while working within MISP and the raw data(so that's what I initially attributed it to), and just wanted to see it visualized outside of MISP, it's really good analysis.
I've also added the references to the individual institution at the unitracker site as well.
To answer your question, the visualization is just a simple cross-filter. I guess the differences are the categorized and topic-based breakdowns/filtering, filtering by description and it includes a map. I did consider adding a network graph, but my focus isn't really visualization.
I've also added the references to the individual institution at the unitracker site as well.
To answer your question, the visualization is just a simple cross-filter. I guess the differences are the categorized and topic-based breakdowns/filtering, filtering by description and it includes a map. I did consider adding a network graph, but my focus isn't really visualization.
> we are falling far behind in many areas, including cyber security
In terms of quantity and quality of talent, I don't think the western world would fall behind China, especially with their strict control of information. Most people there will have difficulty independently learning about cybersecurity.
The difference is that most talent is captured by the private sector with higher compensation or bounties. Meanwhile, China can very easily compel anyone they need into the government so the % utilization on outward attacks is probably higher.
In terms of quantity and quality of talent, I don't think the western world would fall behind China, especially with their strict control of information. Most people there will have difficulty independently learning about cybersecurity.
The difference is that most talent is captured by the private sector with higher compensation or bounties. Meanwhile, China can very easily compel anyone they need into the government so the % utilization on outward attacks is probably higher.
> Most people there will have difficulty independently learning about cybersecurity.
Speaking from my own limited anecdata, but since the 90s in order to use the internet in China you basically had to be somewhat proficient in "cybersecurity" just because of all the required hoops to jump through. There were definitely a lot of script kiddies, but the Chinese exploit scene (amateur and professional) has always been bustling. And just personally speaking, the most truly awe-inspiring and resourceful hackers I've ever known have been Russian, or Chinese. Like actual 10x engineers who think that walls put in place for other people don't exist for them.
Speaking from my own limited anecdata, but since the 90s in order to use the internet in China you basically had to be somewhat proficient in "cybersecurity" just because of all the required hoops to jump through. There were definitely a lot of script kiddies, but the Chinese exploit scene (amateur and professional) has always been bustling. And just personally speaking, the most truly awe-inspiring and resourceful hackers I've ever known have been Russian, or Chinese. Like actual 10x engineers who think that walls put in place for other people don't exist for them.
Western society is criminalizing and repressing such culture, so China has already won because they fail at doing the same.
They are very clear about who is a valid target though. I think you’ll quickly find that those attacking domestic targets rapidly disappear.
Kinda works both ways. In many western countries you still go to jail for refusing to give private encryption keys
Or they convict you for money laundry because you developed a crypto phone they can't crack and don't have any legal means to destroy you. ( Dutch example, and yes - the guy payed taxes everything, they made him hang because of a single client of a client his client his client being involved with shady things. )
State-Spite, Repression and such is rising globally. The rule of law is gone.
Any state actor who puts in the effort can get pretty good, and some countries make a very specific effort in this area. North Korea is one. Imagine the brightest people in your state (say, population 26 million) were all nudged into one very specific talent funnel, with the goal of stealing money for the government.
China is different. Not quite as focused in terms of sheer government directive, but just think of the Chinese people you do know and extrapolate out the level of effort and talent. Being overconfident seems like a mistake.
China is different. Not quite as focused in terms of sheer government directive, but just think of the Chinese people you do know and extrapolate out the level of effort and talent. Being overconfident seems like a mistake.
> China can very easily compel anyone they need into the government
I have worked with people in Chinese tech companies and in Chinese tech ministries, and I don't think this statement is true, any more than in the US. In the US, there are talented techies who work for FAANG, startups, Palantir, NSA, etc etc. Similarly in China.
I have worked with people in Chinese tech companies and in Chinese tech ministries, and I don't think this statement is true, any more than in the US. In the US, there are talented techies who work for FAANG, startups, Palantir, NSA, etc etc. Similarly in China.
Every ordinary Chinese needs to self-learn some cybersecurity to do daily things, like to watch YouTube, or to send messages to others without worrying being censored
There's a big difference between using tools intended for general population and being skilled enough in offensive security to make a difference. It may incentivise some people to learn further, but I don't think the effect would be that large. It's kind of like everyone at Uni knowing about P2P a few years ago - but they knew nothing about protocol design.
The ordinary people have their douyin/bilibili and fear of the party so they don't need to learn those things
Why would ordinary Chinese people fear the party? The party has been overseeing the greatest expansion of wealth in human history combined with a massive internal propaganda effort which I would assume is pitching them as the good guys and downplays all the brutal stuff they've done
If anything I'd expect ordinary people to be far too trusting that the authorities are reasonable and friendly. They must have real problems with earnest, motivated and well meaning people wandering off the approved parts of the internet into censored topics and getting confused by whatever happens next.
If anything I'd expect ordinary people to be far too trusting that the authorities are reasonable and friendly. They must have real problems with earnest, motivated and well meaning people wandering off the approved parts of the internet into censored topics and getting confused by whatever happens next.
You're forgetting all the corruption and hypocrisy in China. Do you think the individuals that make up the authorities act in a "reasonable and friendly" towards regular people who interact with them? The contradictions seen by anyone who's paying attention undermine the trust you posit and some fraction of the propaganda messages.
It kinda feels like you understand China as a thought experiment and not a real place.
It kinda feels like you understand China as a thought experiment and not a real place.
Fear getting disappeared/jailed for doing something forbidden. You're right that they may not see it as "fear of the party" from inside. More like "why would I do something illegal". But in a system like that those things are actually equivalent.
> In terms of quantity
At the very least China is generally gonna have everyone else beat on quantity of people involved in quite a lot of things.
At the very least China is generally gonna have everyone else beat on quantity of people involved in quite a lot of things.
check AI, green energy, EV, mobile computing, cloud computing, quantum stuff, robots etc. it is pretty much China vs US now when it comes to quality.
how many people would seriously believe that EU or Japan can possibly compete with China on its own in terms of quality for those above mentioned sectors.
just looking at those low quality & high pollution Japanese & European cars.
how many people would seriously believe that EU or Japan can possibly compete with China on its own in terms of quality for those above mentioned sectors.
just looking at those low quality & high pollution Japanese & European cars.
Is the last line said ironically? Japanese brands long have and continue to absolutely dominate long term reliability ratings for vehicles, and the first mass market hybrid and full EV vehicles came from Japan.
If you’re talking about innovation and mass EV manufacturing, sure the US and China are leading, but the European Volkswagen and BMW Groups are still competitive. Japan is admittedly a laggard in the EV market, but largely because EVs are still a luxury good and Japanese brands are primarily mainstream.
If you’re talking about innovation and mass EV manufacturing, sure the US and China are leading, but the European Volkswagen and BMW Groups are still competitive. Japan is admittedly a laggard in the EV market, but largely because EVs are still a luxury good and Japanese brands are primarily mainstream.
> Japanese brands long have and continue to absolutely dominate long term reliability ratings for vehicles
such hard earned experience is no longer relevant in the era of EV.
> but the European Volkswagen and BMW Groups are still competitive
none of them is even capably of designing self driven cars on their own. same for the AI based infotainment systems fitted on EVs. they are just Canon in 2024/2025.
> EVs are still a luxury good
I wouldn't call it luxury. It is the cheapest option to own a car in Shanghai, BYD Seagull is being offered for $9k USD.
> Japanese brands are primarily mainstream
they have already lost the battle. if EV makers can't build their own self driving systems and those AI based infotainment systems, then they are in the wrong business. Batteries is another story that can not be ignored, Japan and the EU do not have any meaningful control on that.
I don't see any chance how European or Japanese car makers can survive in mid term.
such hard earned experience is no longer relevant in the era of EV.
> but the European Volkswagen and BMW Groups are still competitive
none of them is even capably of designing self driven cars on their own. same for the AI based infotainment systems fitted on EVs. they are just Canon in 2024/2025.
> EVs are still a luxury good
I wouldn't call it luxury. It is the cheapest option to own a car in Shanghai, BYD Seagull is being offered for $9k USD.
> Japanese brands are primarily mainstream
they have already lost the battle. if EV makers can't build their own self driving systems and those AI based infotainment systems, then they are in the wrong business. Batteries is another story that can not be ignored, Japan and the EU do not have any meaningful control on that.
I don't see any chance how European or Japanese car makers can survive in mid term.
Interesting also is the type of names that appear in so many western academic journals. What I mean to say is that even in Western journals "Alice" and "Bob" is quite rare
when "alice" and "bob" can become a lawyer to talk their clients into paying some stupid amount, why bother studying STEM.
> especially with their strict control of information.
You have gross misunderstanding of how this strict control works. It isn't like novels or North Korea where some govt agency is creating/curating the info.
You have gross misunderstanding of how this strict control works. It isn't like novels or North Korea where some govt agency is creating/curating the info.
> especially with their strict control of information. Most people there will have difficulty independently learning about cybersecurity.
I'm puzzled by this assertion. I know quite a few self-taught infosec folks who grew up there. China is not North Korea. The government, by and large, doesn't monitor what you're doing day-to-day, unless you're a political activist or some other "undesirable". The Great Firewall doesn't stop you from accessing infosec content; and in any case, the use of VPNs is prevalent among techies.
To be fair, the parent's claim that China is "ahead" in infosec also feels like fearmongering. The one thing that's true for China is that their government has far fewer qualms about hacking Western infrastructure to get dirt on dissidents, steal IP, and so on. But that's a matter of ethics and law, not tech.
I'm puzzled by this assertion. I know quite a few self-taught infosec folks who grew up there. China is not North Korea. The government, by and large, doesn't monitor what you're doing day-to-day, unless you're a political activist or some other "undesirable". The Great Firewall doesn't stop you from accessing infosec content; and in any case, the use of VPNs is prevalent among techies.
To be fair, the parent's claim that China is "ahead" in infosec also feels like fearmongering. The one thing that's true for China is that their government has far fewer qualms about hacking Western infrastructure to get dirt on dissidents, steal IP, and so on. But that's a matter of ethics and law, not tech.
> The one thing that's true for China is that their government has far fewer qualms about hacking Western infrastructure to get dirt on dissidents, steal IP, and so on. But that's a matter of ethics and law, not tech.
As opposed to the DoD, which strictly fights for freedom, liberty, and democracy?
As opposed to the DoD, which strictly fights for freedom, liberty, and democracy?
> As opposed to the DoD, which strictly fights for freedom, liberty, and democracy?
Yes, the whataboutism is unwarranted here. The US government is no angel, but is far more constrained in this regard. The bar to become "the enemy of the state" is much higher - for example, your comment won't get you in trouble here. The US government also wouldn't, say, hack Spotify and snoop on their business plans to prop up a competing US startup - something that is commonplace with the Chinese intelligence apparatus.
Yes, the whataboutism is unwarranted here. The US government is no angel, but is far more constrained in this regard. The bar to become "the enemy of the state" is much higher - for example, your comment won't get you in trouble here. The US government also wouldn't, say, hack Spotify and snoop on their business plans to prop up a competing US startup - something that is commonplace with the Chinese intelligence apparatus.
> The bar to become "the enemy of the state" is much higher - for example, your comment won't get you in trouble here.
I think you're drastically overestimating the effect of being sarcastic about jingoistic rhetoric on the chinese internet. I imagine China, much like the DoD, is quite proud of their ability to penetrate systems and cause havoc.
> The US government also wouldn't, say, hack Spotify and snoop on their business plans to prop up a competing US startup - something that is commonplace with the Chinese intelligence apparatus.
I can't imagine there's much worth taking from Spotify. Meanwhile, if you think the US won't steal technology from China when there's something worth stealing, you're a massive fool.
I think you're drastically overestimating the effect of being sarcastic about jingoistic rhetoric on the chinese internet. I imagine China, much like the DoD, is quite proud of their ability to penetrate systems and cause havoc.
> The US government also wouldn't, say, hack Spotify and snoop on their business plans to prop up a competing US startup - something that is commonplace with the Chinese intelligence apparatus.
I can't imagine there's much worth taking from Spotify. Meanwhile, if you think the US won't steal technology from China when there's something worth stealing, you're a massive fool.
> To be fair, the parent's claim that China is "ahead" in infosec also feels like fearmongering. The one thing that's true for China is that their government has far fewer qualms about hacking Western infrastructure to get dirt on dissidents, steal IP, and so on. But that's a matter of ethics and law, not tech.
I've heard China also has many more personnel working in this space.
I've heard China also has many more personnel working in this space.
Ive also heard that China has many more people living in it than the US. Ive also heard that Chinese higher education system is state funded
> Ive also heard that China has many more people living in it than the US. Ive also heard that Chinese higher education system is state funded
So? It kinds sounds like you're making an excuse, but excuses don't do anything to address the capability difference caused by the larger number of personnel.
So? It kinds sounds like you're making an excuse, but excuses don't do anything to address the capability difference caused by the larger number of personnel.
The US used to be by far the largest country in the developed world. It could be argued that sheer numbers allowed it to succeed and dominate throughout the previous century. Today the US is no longer the largest country in the developed world, not by a long shot
What's your point? Your comment doesn't really address anything relevant regarding the US's goals and positioning to achieve them.
For instance, if the US wants to to secure its networks and be able to respond effectively to hacking threats from its geopolitical rivals, it may have to invest proportionally more of its human resources in infosec to remain competitive. I see no good reason why it can't do that.
Also, noting that one reason China may be ahead in infosec is because it may have many more people working in that area was to rebut claims that "China is ahead in infosec" was "fearmongering."
In short, China having a larger population may be one reason why they're ahead, but that why is not very relevant to decisions about what to do about it.
For instance, if the US wants to to secure its networks and be able to respond effectively to hacking threats from its geopolitical rivals, it may have to invest proportionally more of its human resources in infosec to remain competitive. I see no good reason why it can't do that.
Also, noting that one reason China may be ahead in infosec is because it may have many more people working in that area was to rebut claims that "China is ahead in infosec" was "fearmongering."
In short, China having a larger population may be one reason why they're ahead, but that why is not very relevant to decisions about what to do about it.
Im just offering you an explanation about evolution of powers in the world, and human resources is a huge factor. Already in his last mandate Trump was constantly talking about the power of US military, much like Russia does about its nukes. These sort of things are done out of weakness, not strength
> Im just offering you an explanation about evolution of powers in the world, and human resources is a huge factor.
Sorry, that wasn't an explanation that was needed nor asked for.
And its sounds like weird sort of demographic determinism, which is kinda so oversimple to be obviously not true.
Sorry, that wasn't an explanation that was needed nor asked for.
And its sounds like weird sort of demographic determinism, which is kinda so oversimple to be obviously not true.
I'm sorry I didnt realise you think Im only allowed to respond in the way you find appropriate.
If you do not want to take into account China's huge and relatively well educated and quite capable working class that is your issue
If you do not want to take into account China's huge and relatively well educated and quite capable working class that is your issue
That doesn’t sound like China at all. Having worked in Beijing for 9 years, they pay techies fairly well, not USA FAANG well, but better than Japan, much of Europe, Korea, even Singapore. So there is a lot of private sector movement in these areas, not just government. Information is easily obtained, piracy rates are still very high so it’s not like anything is really locked down behind a paywall. There are plenty of hackers who are in it with a passion, not just for the money, much like you’d find in the states or anywhere in the developed world.
Hahahhahahah no way. Salaries in Japan, Korea, Singapore are WAY better than China.
If you consider the exchange rate, of course, salaries in China would be much lower.
If considering purchasing power and cost of living, Chinese salaries would have a relatively high level of competitiveness.
There are sooo many programmers in China that they don’t value programming. You get paid peanuts because there’s so many people to do the job.
Better than avg(China) - sure.
Better than tier1(China), where most of the research happens - the salaries in China are easily beating Japan and significant portion of the EU "centers" on top of having significantly lower cost of living on most of the relevant dimensions.
Better than tier1(China), where most of the research happens - the salaries in China are easily beating Japan and significant portion of the EU "centers" on top of having significantly lower cost of living on most of the relevant dimensions.
As I said in another thread, you can live cheaply in Japan if you're about 20 minutes by train from Tokyo.
In that thread, someone said that rent is expensive in Beijing and Shanghai. It looks similar.
Anyway, in China I heard that if you go to hospital in a different household registration, you have to pay the full medical costs. It sounds the cost of living in China is expensive.
Anyway, in China I heard that if you go to hospital in a different household registration, you have to pay the full medical costs. It sounds the cost of living in China is expensive.
> in China I heard that if you go to hospital in a different household registration, you have to pay the full medical costs.
When talking about paying such full medical costs, let me share some concrete numbers with you, all numbers are from tier 1 cities like Shanghai -
Chest CT scan is 170-200 RMB, or 25-30 USD MRI scan is 260-460 RMB, or 35-65 USD Ultrasound is 20-170 RMB, or 3-25 USD PET CT is 6500 RMB, or 900 USD
https://ybj.sh.gov.cn/cmsres/9b/9baabfec6f6c4e3fa03d6289f5e7...
Ambulance cost is shockingly low, 30 RMB per call plus 7 RMB per KM, that is 4 USD per call plus 1 USD per KM.
https://wx.sh120.sh.cn/mobjsp/helpinfo/FeeScale.jsp?communit...
when you can't afford those tests in the west or facing a stupidly long waiting period, don't be sad, just jump onto an airplane to get yourself checked & treated in Shanghai. You'd still save heap of money saved after such extra travel costs.
When talking about paying such full medical costs, let me share some concrete numbers with you, all numbers are from tier 1 cities like Shanghai -
Chest CT scan is 170-200 RMB, or 25-30 USD MRI scan is 260-460 RMB, or 35-65 USD Ultrasound is 20-170 RMB, or 3-25 USD PET CT is 6500 RMB, or 900 USD
https://ybj.sh.gov.cn/cmsres/9b/9baabfec6f6c4e3fa03d6289f5e7...
Ambulance cost is shockingly low, 30 RMB per call plus 7 RMB per KM, that is 4 USD per call plus 1 USD per KM.
https://wx.sh120.sh.cn/mobjsp/helpinfo/FeeScale.jsp?communit...
when you can't afford those tests in the west or facing a stupidly long waiting period, don't be sad, just jump onto an airplane to get yourself checked & treated in Shanghai. You'd still save heap of money saved after such extra travel costs.
Not in tech. There is a weird de-emphasis of programmers in countries that aren’t the USA or mainland china. So a programmer from Japan with some experience/skills can move to Beijing (yes, there were many Japanese expat SWEs when I was there) for a better salary.
What? I'm Japanese but I've never heard a story about changing jobs to Chinese company.
I heard a lot of stories about changing jobs to GAFAM.
Could you tell me more about that?
Could you tell me more about that?
I don't think it's that much of an outrageous claim, plenty of our fellow countrymen works at local regional branches and English wings of China-owned companies these days. It doesn't take much stretch from there to imagine some of them moving to near their HQ.
It's annoying that sometimes people thinks there has to be basic mutual intelligibility between Chinese and Japanese languages against the reality that there's none, but this is not about that at all. Chill.
It's annoying that sometimes people thinks there has to be basic mutual intelligibility between Chinese and Japanese languages against the reality that there's none, but this is not about that at all. Chill.
Is this response about a Chinese-owned company?
They said about Microsoft in other responses and I don't receive like that.
I'm not good at English, so I don't get the nuances that native speakers do.
I'm not good at English, so I don't get the nuances that native speakers do.
Microsoft paid more in Beijing than Tokyo while I was there, it turns out even experienced programmers in Tokyo don’t make $200k/year. Especially if you have a PhD or research in a hot field, you can get a pretty good job in richer Chinese cities. But an apartment is probably more expensive to rent in Beijing, and definitely in Shanghai, than it is in much of Tokyo, so there are trade offs.
It's true that rents in Tokyo are expensive, but Kawasaki or Adachi, where the commute takes about 20 minutes, are cheap.
I don't know about the salary, but I checked X or blog and it seems that some are work in the US headquarters, but none in Beijing.
Anyway, when are you there? It looks you are talking in 2010.
Anyway, when are you there? It looks you are talking in 2010.
I think this is just baseless prejudice. In my experience, having lived in the West and in the East, I found that on average, at least in the urban population, people in the communist and ex-communist space seem to be far more computer literate while computer experts seem to mentally get around "magic and fluff" much easier. Also the authorities are far less concerned about "incorrect" ideologies creeping through (especially through academia) than you probably immagine.
"Pretend inferiority and encourage his arrogance."
I came across that group (ASPI) before and wasn’t too impressed.
Their name suggests they are a public agency—in fact, though sponsored by the AUS defence ministry, they are non-governmental and funded in part by weapons manufacturers and foreign governments.
Their project [0] describes numerous civilian universities as “very high risk,” unnecessarily raising fears that ordinary Chinese students and researchers are dangerous.
Especially since students uni choices are heavily determined by gaokao scores, I don’t think placing labels on people based on their undergrad uni as if they handpicked them for whatever defense connections they may have makes any sense.
This is what the US is doing with Proclamation 10043 under both Trump I and Biden. Steven Miller, who will be returning to a similar role in Trump II, recently suggested banning all Chinese citizens from student visas in the US, demonstrating this irresponsible rhetorics effect.
Moreover, Australia is basically a vassal state of the US for intelligence matters—-see the debate about whether the CIA ousted the only prime minister to question the NSA’s Pine Gap facility on Australian soil. [1]
[0] https://unitracker.aspi.org.au/universities/
[1] https://en.wikipedia.org/wiki/Alleged_CIA_involvement_in_the...
Their name suggests they are a public agency—in fact, though sponsored by the AUS defence ministry, they are non-governmental and funded in part by weapons manufacturers and foreign governments.
Their project [0] describes numerous civilian universities as “very high risk,” unnecessarily raising fears that ordinary Chinese students and researchers are dangerous.
Especially since students uni choices are heavily determined by gaokao scores, I don’t think placing labels on people based on their undergrad uni as if they handpicked them for whatever defense connections they may have makes any sense.
This is what the US is doing with Proclamation 10043 under both Trump I and Biden. Steven Miller, who will be returning to a similar role in Trump II, recently suggested banning all Chinese citizens from student visas in the US, demonstrating this irresponsible rhetorics effect.
Moreover, Australia is basically a vassal state of the US for intelligence matters—-see the debate about whether the CIA ousted the only prime minister to question the NSA’s Pine Gap facility on Australian soil. [1]
[0] https://unitracker.aspi.org.au/universities/
[1] https://en.wikipedia.org/wiki/Alleged_CIA_involvement_in_the...
China mostly works as a meritocracy. The US has done that mostly int the past but the current leadership is essentially adding witchdoctors and criminals to the government departments that will be overseeing security and infrastructure and we will likely face some dire situations and terroristic infrastructure catastrophes over that for the next 4 years or so as the CCP and Russian hackers do whatever they want with our systems because the fox is now in the hen house.
> and the copying of certain information that was subject to U.S. law enforcement requests pursuant to court orders
Is this legal speak for saying, "They're using our backdoors without our permission."?
Is this legal speak for saying, "They're using our backdoors without our permission."?
Yes, they leveraging CALEA mandated infrastructure.
https://www.techdirt.com/2024/10/16/wyden-calea-hack-proves-...
https://www.wyden.senate.gov/imo/media/doc/wyden_letter_to_f...
https://en.wikipedia.org/wiki/Communications_Assistance_for_...
https://www.techdirt.com/2024/10/16/wyden-calea-hack-proves-...
https://www.wyden.senate.gov/imo/media/doc/wyden_letter_to_f...
https://en.wikipedia.org/wiki/Communications_Assistance_for_...
Can you imagine if the proponents of the Clipper Chip had actually won the argument? Yeesh. This is inexcusable.
[deleted]
[deleted]
> Can you imagine if the proponents of the Clipper Chip had actually won the argument?
Given that 90% of smartphone hardware comes from 2-3 manufacturers, I actually can imagine it pretty well...
Given that 90% of smartphone hardware comes from 2-3 manufacturers, I actually can imagine it pretty well...
Wyden is so good on this stuff.
He's getting up there in years, I hope he hangs out a while longer. We could use more senators like him.
Damn, if only some one, some where, at some point, had mentioned that there's no such thing as a secure backdoor to encryption. Oh well, maybe such events are impossible to predict.
It's legal speak for "They are looking at who we have wiretaps on", which any country would be interested in, just to see which of their assets are being watched, for counter-counter-espionage purposes.
That is incorrect. While you're idea probably is interesting to them, they are indeed leveraging the infrastructure to "live off the land" doing their own collect. They are very much doing their own targeting.
How would their own targeting relate to "copying of certain information that was subject to U.S. law enforcement requests pursuant to court orders"? AFAIK, telecoms enforcement requests subject to court orders in the US mean one thing, and one thing only: lawful interception of communication.
There is no known limit to the scope of what LE can monitor, and there is no public record to access or analyze in the case of sealed documents. So it could, for all we know, be anyone and everyone.
Remember, way back when, AT&T just gave the NSA full access to their network.
Remember, way back when, AT&T just gave the NSA full access to their network.
I'm not sure I'm following your argument in the context of this thread. Are you suggesting there were no surveillance court orders whose targets the Chinese found a d copied?
For cross-referencing with ground surveillance.
I like the tacit implication that all 335 million-odd Americans might be subject to requests pursuant to court orders, but none of us can ever really know for sure since those records might be sealed, expunged, vacated or classified.
It's like we're on the $500,000 question and my Phone-a-Friend still has Snowden on the line.
It's like we're on the $500,000 question and my Phone-a-Friend still has Snowden on the line.
> I like the tacit implication that all 335 million-odd Americans [...]
I wouldn't worry too much.
Us unAmericans in the rest of the world don't have any constitutional guarantees to save us from the US spooks (nor from each other), and you don't have any constitutional guarantees to save you from the rest of the world, either.
So the flimsy guarantees that would in theory save you from your own spooks are really just a drop in the bucket.
I wouldn't worry too much.
Us unAmericans in the rest of the world don't have any constitutional guarantees to save us from the US spooks (nor from each other), and you don't have any constitutional guarantees to save you from the rest of the world, either.
So the flimsy guarantees that would in theory save you from your own spooks are really just a drop in the bucket.
Trickle-down surveillance can lead to on-demand local neo-stasi orgs in every country, representing local, national, transnational or global interests.
Like the WestWorld S3 “RICO crime app”.
Like the WestWorld S3 “RICO crime app”.
Does this mean that they were able to (ab)use LI infra?
https://en.wikipedia.org/wiki/Lawful_interception
https://en.wikipedia.org/wiki/Lawful_interception
Yes. What no one here bothers to even mention is that APTs have been doing this very thing since the 2004 Athens Affair. It didn't feed into the sanctimony so it isn't mentioned.
I was just reading about the Greece incident linked on the wiki page. Absolutely staggering stuff - none of which I heard of before!
Damn, who could've seen this coming!?
Yep. Pretty much the dystopian governments go-to playbook for surveillance. Find a private entity that is providing a communication service they can't spy on, then pressure them to put in a backdoor with threats of jail, etc.
Former CEO of Qwest Communications Joe Nachio claims he fought the NSA's initial requests for these backdoors, and was rewarded with being taken to court for insider trading. Remember no one at the top of these companies got there without breaking some rules along the way.
https://en.wikipedia.org/wiki/Joseph_Nacchio
Former CEO of Qwest Communications Joe Nachio claims he fought the NSA's initial requests for these backdoors, and was rewarded with being taken to court for insider trading. Remember no one at the top of these companies got there without breaking some rules along the way.
https://en.wikipedia.org/wiki/Joseph_Nacchio
[deleted]
No it is not, because these are not backdoors, the entities legally own the data users have provided them and the courts require them to share the data for investigative purposes. When the FBI pressed Apple to break its encryption, it would not had been a backdoor, but simply a different product that Apple would've offered. A backdoor would be a secret exploit that circumvents encryption, or other security methods.
You've probably conflated the saying "going through the backdoor" with the noun backdoor, which is an understandable mistake to make.
Conflating the two is even easier when the backdoor is morally questionable i.e. When someone purposefully installs a wooden backdoor on a bankvault and says it's so that we don't need to go through the whole rigmarole of opening the main vault-door. Yes it allows them to do their job of checking what's in safety deposit boxes easier but the door itself is an evil.
Conflating the two is even easier when the backdoor is morally questionable i.e. When someone purposefully installs a wooden backdoor on a bankvault and says it's so that we don't need to go through the whole rigmarole of opening the main vault-door. Yes it allows them to do their job of checking what's in safety deposit boxes easier but the door itself is an evil.
"Using our backdoors" is what was said, not "going through the backdoor". Backdoors have a very specific meaning in computer security. US law enforcement is not using backdoors to access the data of US companies.
A backdoor bypasses legitimate access mechanisms. Whether it is a backdoor or not depends fully on whether you believe lawful intercept is a legitimate access mechanism. And I think the law is on the side of it being not a backdoor.
We've had multiple bills proposed by multiple countries for government mandated backdoors. Multiple articles refer to how these bills would create backdoors, multiple computer security experts say the bills would create backdoors in the software. Under your definition of the word they'd all be using the word incorrectly because logically no bill could create a legal backdoor by definition.
It's seems there's a semantic schism on "the point in software where security is weak enough (either purposefully or unkowingly) for 3rd party access by a 3rd party" and "the point in software where security is purposefully weakened for 3rd party access by the legal requirement of a 3rd party" there's definitely a distinction but I generally conflate the two, perhaps incorrectly, under the word backdoor.
If you've got another more appropos word for this purposeful and legal weakining of security for non primary user/provider access I'd love to know it because sadly I feel I'd use it fairly often in the coming years.
It's seems there's a semantic schism on "the point in software where security is weak enough (either purposefully or unkowingly) for 3rd party access by a 3rd party" and "the point in software where security is purposefully weakened for 3rd party access by the legal requirement of a 3rd party" there's definitely a distinction but I generally conflate the two, perhaps incorrectly, under the word backdoor.
If you've got another more appropos word for this purposeful and legal weakining of security for non primary user/provider access I'd love to know it because sadly I feel I'd use it fairly often in the coming years.
These articles use the word "backdoor" for effect, for example <https://www.schneier.com/blog/archives/2021/08/apple-adds-a-...>. The bills you refer to by multiple countries simply want their own in-house wiretapping apparatus, because they don't want to be dependent on the US. Specifically, I'm thinking of EU's "chat control". Ironically those who oppose it are unwittingly doing the bidding for a more powerful US. The internet is fully wiretapped and there is no end in sight.
No they use the word backdoor because there is no better word for these pathwatys/purposefully created weak spots in access to the software. Seriously please give me one that emphasises the security detriment to the 1st party user and i'll happily use it instead.
I'll also add that ironically those who don't oppose these bills are unwittingly doing the bidding of strategic adversaries as demonstrated quite adequately by the PRC here.
I'll also add that ironically those who don't oppose these bills are unwittingly doing the bidding of strategic adversaries as demonstrated quite adequately by the PRC here.
A backdoor in the technical sense (which is the real topic of this whole conversation) is one that bypasses the known way of entry. For an "End to end encrypted" communication channel, a backdoor allows someone to view the communication without being on either of the "ends".
The problem is not whether the backdoor was legally mandated or not, and whether legal authorities are misusing them or not, the problem is that it exists. And the existence by itself is enough to let someone ignore any legal mandates and view the comms.
The problem is not whether the backdoor was legally mandated or not, and whether legal authorities are misusing them or not, the problem is that it exists. And the existence by itself is enough to let someone ignore any legal mandates and view the comms.
Whenever I see these news & FBI releases about Chinese state-sponsored hackers breaching systems in America, I wonder whether the same thing happens over there: American malware and hacker groups attacking & laying landmines in China's internet infrastructure, although the Chinese may not publicize these exploits because their system opts to maintain an air of invincibility.
Yes, the US famously has breached foreign infrastructure. In Confessions of an Economic Hitman[0], Josh Perkins discusses how he knows on good authority the US could shutdown the Japanese electrical grid with relative ease if needed, which an ally. Imagine what they do to perceived enemies.
[0]: https://www.goodreads.com/book/show/2159.Confessions_of_an_E...
This book was on of my favorite books to site in extemporaneous speaking events.
[0]: https://www.goodreads.com/book/show/2159.Confessions_of_an_E...
This book was on of my favorite books to site in extemporaneous speaking events.
Confessions is best read as historical fiction. It's brilliantly written. But the author has never been able to substantiate much [1].
[1] https://en.wikipedia.org/wiki/Confessions_of_an_Economic_Hit...
[1] https://en.wikipedia.org/wiki/Confessions_of_an_Economic_Hit...
True, but I would also deny most of those accusations even if true If I was the State Department. If I was the US state department. I personally know a McKensey Principal who's government work isn't that far off of what Perkins describes. and they love bragging about it too.
The accusations also seem unsubstantiated and ideological in nature. Eg
> Mallaby said that Perkins' conception of international finance is "largely a dream" and that his "basic contentions are flat wrong" because "the poor don't always lose" when developing countries borrow money.
It's not exactly an uncommon take to center conceptions neocolonialism around the World Bank and the IMF. This just seems like a Steven Pinker blunt rotation picking on the work.
> Mallaby said that Perkins' conception of international finance is "largely a dream" and that his "basic contentions are flat wrong" because "the poor don't always lose" when developing countries borrow money.
It's not exactly an uncommon take to center conceptions neocolonialism around the World Bank and the IMF. This just seems like a Steven Pinker blunt rotation picking on the work.
The US famously compromised the Greek phone switches a while back, which were written in Erlang and thus so was the malware (correction--it was actually the proprietary predecessor to Erland, called PLEX). An telecom employee died under mysterious circumstances in the aftermath and the US Embassy in Athens was found to have close ties to the individuals involved; a CIA employee was later charged and fled back to the US. All in a days work for the "leaders of the free world."
Wasn't it that the Greek govt allowed the NSA in to monitor the Olympics but they overstayed their welcome?
They were invited to provide some kind of assistance, but I can't imagine they were given the green light to upload arbitrary code into the countrywide telephone exchange without notifying the Greeks at all, or providing a copy of it.
It's not just that they added Greek officials phones to the monitoring list alongside legitimate suspects, but the whole program itself was hidden. Nor is it clear how the US could have forwarded any legitimate threats captured without admitting the whole program.
The whole Olympics rationale is a bit weird too. Yes, it is a big event and there have been a few terrorist attacks in its history, but relatively few considering its huge scale. Also, almost every state actor is participating and thus unlikely to cause any major trouble. It's a big propaganda thing for most of the US-order enemies. It doesn't really make sense why the NSA would have been authorized such extensive access, to the exclusion of the host country's own personnel, instead of requesting help from neighboring EU countries that already presumably cooperate on law enforcement.
That sounds like a cover story the US made up to change it from "act of war" level to "oops we forgot to ask if this was okay."
It's not just that they added Greek officials phones to the monitoring list alongside legitimate suspects, but the whole program itself was hidden. Nor is it clear how the US could have forwarded any legitimate threats captured without admitting the whole program.
The whole Olympics rationale is a bit weird too. Yes, it is a big event and there have been a few terrorist attacks in its history, but relatively few considering its huge scale. Also, almost every state actor is participating and thus unlikely to cause any major trouble. It's a big propaganda thing for most of the US-order enemies. It doesn't really make sense why the NSA would have been authorized such extensive access, to the exclusion of the host country's own personnel, instead of requesting help from neighboring EU countries that already presumably cooperate on law enforcement.
That sounds like a cover story the US made up to change it from "act of war" level to "oops we forgot to ask if this was okay."
The US could do a great many things to Japan with relative ease, given their (relatively) enormous military presence in the country.
In the last episode of the risky business podcast they chatted about the "GoblinRAT" based on this Russian analysis/post-mortem:
https://rt-solar.ru/solar-4rays/blog/4861/
Likely an attack done by US intelligence.
There has been quite a few of these with a lot of details released by Russian techies - this is just the latest one I know of.
https://rt-solar.ru/solar-4rays/blog/4861/
Likely an attack done by US intelligence.
There has been quite a few of these with a lot of details released by Russian techies - this is just the latest one I know of.
According to Chinese state media, the US installed malware in systems in Chinese universities tied with military, e.g. Northwestern Polytechnical University
According to Chinese state media, Chinese state media is never wrong
Believe it or not, it's up to you; the same goes with FBI
FBI have admitted it was wrong in a number of high profile cases, so no, FBI is not always right according to FBI.
The FBI is not the same as a news agency however.
So that point is null.
So that point is null.
Both depend on whether you believe in the government actually. When we say "Chinese state media", we're really talking about a media controlled by the government, especially for those political topics
This would be true even with private actors, at the end of the day it's whoever has concrete evidence of something taking place.
If the FBI is going to make the broad statement that China is hacking the USA, it'll have to back that statement up by evidence presented in court against individuals the FBI has investigated for hacking into US companies/government orgs.
If the FBI is going to make the broad statement that China is hacking the USA, it'll have to back that statement up by evidence presented in court against individuals the FBI has investigated for hacking into US companies/government orgs.
Seems that you just don't believe the other side has done some investigation and therefore did not search for it. I'm not saying that either incident is fake but you've just proved my point of view.
You are correct that we choose what to believe based on what we think is more likely or useful. We don't have time to research all the things
But that is not relevant to point that Chinese state media (which is in a way all their media, like becoming in Russia now) is wrong and lies regularly but will never undermine the cult of personality at the top of the government that owns it by admitting the lies.
To deny that you need to go all tinfoil on me and say most instances where they lied is made up by the West. Like idk Tiananmen didn't happen or whatever. If you believe that then sure.
But that is not relevant to point that Chinese state media (which is in a way all their media, like becoming in Russia now) is wrong and lies regularly but will never undermine the cult of personality at the top of the government that owns it by admitting the lies.
To deny that you need to go all tinfoil on me and say most instances where they lied is made up by the West. Like idk Tiananmen didn't happen or whatever. If you believe that then sure.
I don't believe any side who doesn't present in a good evidence based way, in other words verifiable and or replicable data.
On that front China has a far worse track record and institutions that uses evidence based truth telling.
On that front China has a far worse track record and institutions that uses evidence based truth telling.
I think its kind of hard to imagine its not totally complementary in this respect.
Even just being rational, if we have no qualms spying on our European allies, it seems a safe bet to assume we would be doing that and much more to China too.
https://www.bbc.com/news/world-europe-57302806
Even just being rational, if we have no qualms spying on our European allies, it seems a safe bet to assume we would be doing that and much more to China too.
https://www.bbc.com/news/world-europe-57302806
Considering how deeply infiltrated German intelligence services were/are by Russia, it's hard to feel bad about spying on them.
At least the Dutch are competent.
At least the Dutch are competent.
Belgacom, Diginotar, Stuxnet Anything involving Fox-IT. Just to mention three cases involving black mailed ministers and involving corrupt intelligence public servants.
The Dutch are not competent, they are corrupt as hell.
Access to anything Dutch is for sale and on bulk discount.
At least you have CIA openly recruit spies on Twitter: https://x.com/CIA/status/1841468925378171381 I think only CIA and mossad have the confidence to do it this way.
That's wild.
What's the situation like on the ground? I've read that the CCP sentences spies to death and that they catch a lot of them.
What's the situation like on the ground? I've read that the CCP sentences spies to death and that they catch a lot of them.
I don't doubt CCP has sentenced a lot of people to death for spying for US, but I wonder how many of these were actual spies and how many where there just to fill a quota and earn a promotion. Communist regimes are not famous for having respect for their citizens well-being, fair and just justice system, or checks and balances which limit government overreach, especially for intelligence agencies.
Yeah based on that video, it'd be easy to edit the onion address and send them to a honey pot...
China has the Great Firewall segregating most international access from the country's network. Additionally, China (moreso than most) has a motivation to onshore as much of their software and hardware manufacturing to bolster their own industry.
It's possible that isolated attacks could pop off now and again, but hacking to-and-from China is strictly state controlled.
It's possible that isolated attacks could pop off now and again, but hacking to-and-from China is strictly state controlled.
Their censorship infrastructure isn't security. If anything, it's another thing to hack.
It does have some defensive benefit. Getting legitimate connectivity to work reliably across the Chinese border, is a big pain.
Due to this, Chinese commercial internet infrastructure has very few dependencies on international services.
Western infrastructure by comparison is very vulnerable to distribution of connectivity, attacks on deep sea cables can cause a lot of damage.
Western infrastructure by comparison is very vulnerable to distribution of connectivity, attacks on deep sea cables can cause a lot of damage.
It certainly does happen. See for example under “Targets”: https://en.m.wikipedia.org/wiki/Tailored_Access_Operations
Now if that naming isn't intentional then I don't know what would be ...
The Tao or Dao is the natural way of the universe, primarily as conceived in East Asian philosophy and religion. This seeing of life cannot be grasped as a concept. Rather, it is seen through actual living experience of one's everyday being. The concept is represented by the Chinese character 道, which has meanings including 'way', 'path', 'road', and sometimes 'doctrine' or 'principle'.
You say it like it's hard to get around the Great Firewall in either direction.
[deleted]
[deleted]
I will be interested to see if the Trump administration will target their response at any specific companies or entities related to telecommunications (beyond existing measures) or just focus on existing tariffs and export controls.
I also wonder if information about similar attacks from US allies will be detailed in the coming days, or if the exploits were just limited to our specific back doors (as has been reported in the previous weeks).
China will have convenient amnesia during their next communications lamenting the West’s unprovoked aggression.
I also wonder if information about similar attacks from US allies will be detailed in the coming days, or if the exploits were just limited to our specific back doors (as has been reported in the previous weeks).
China will have convenient amnesia during their next communications lamenting the West’s unprovoked aggression.
[deleted]
almaight(1)
How many are there that we don’t even know they are targeting. That is what would keep me up at night
Is this related to Verizon going down recently?
[deleted]
Snowden: wow, cool
Hey China, could you just like, you know, not do that? That'd be cool.
Thanks!
Thanks!
I will just leave this here.
https://en.wikipedia.org/wiki/Greek_wiretapping_case_2004%E2...
https://en.wikipedia.org/wiki/Greek_wiretapping_case_2004%E2...
Is this a whataboutism?
Friends don't treat friends like this.
Then we should never be friends with China?
They do, they just care less when it's friends doing it. 5-eyes did the same with the entire European parliament. The incident response & reporting ( clean up crew ) was done by a firm who got sold to a British intelligence daughter not much afterwards. You can't make this shit up.
Another famous example would be from the previous cold war era. Dutch telephony routers had Hebrew manuals so they required personnel from Israel for "maintenance". They wiretapped the whole country.
Something something turnabout is fair play
As if they contributed to West even remotely as much as West contributed to them. Help getting lifted from poverty and being given a ton of tech/innovations, turnabout my ass...
Conversely, you could look at that as a mistake on the West's half for letting themselves become so addicted to a foreign power they are ideologically at-odds with. We could have learned this mistake when we sold Pakistan weapons they used to genocide people, or again when we gave Iran weapons they would turn around and use for terrorism, or yet again when we furnish weapons to Israel pitting one ugly nationalist theocracy against another.
All China ever did was exploit capitalism. And if we punished companies for exploiting capitalism then America wouldn't have modern businesses at all.
All China ever did was exploit capitalism. And if we punished companies for exploiting capitalism then America wouldn't have modern businesses at all.
USA never gave weapons beyond required (hostage crisis) to Iran.
And China is doing a lot more than exploiting capitalism. They are pushing neo imperialism just like Russia.
And China is doing a lot more than exploiting capitalism. They are pushing neo imperialism just like Russia.
> USA never gave weapons beyond required (hostage crisis) to Iran.
Same can't be said about Iraq, can it?
> And China is doing a lot more than exploiting capitalism. They are pushing neo imperialism just like Russia.
Oh, absolutely. But none of that mattered to us when China was a fair-weather trade partner, so I frankly find it hilarious that people want to act suddenly offended by Chinese ambition. What, 40 years of trade reliance didn't give you the insight into Xi Jinping you needed?
Same can't be said about Iraq, can it?
> And China is doing a lot more than exploiting capitalism. They are pushing neo imperialism just like Russia.
Oh, absolutely. But none of that mattered to us when China was a fair-weather trade partner, so I frankly find it hilarious that people want to act suddenly offended by Chinese ambition. What, 40 years of trade reliance didn't give you the insight into Xi Jinping you needed?
>Same can't be said about Iraq, can it?
Iraq got most of the weapons from the USSR.
If you mean it's WMD, that was done by tricking the west by proclaiming that Iraq was going to be using chemicals used in WMD for non WMD uses.
>What, 40 years of trade reliance didn't give you the insight into Xi Jinping you needed?
You are correct that the west took a blind eye to the geopolitical goals and ambitions of China, however it started as a strategy in the cold war (counter balance to the USSR) to the naive view that trade of libertarians that free trade makes geopolitical interest go away and peace comes in.
Iraq got most of the weapons from the USSR.
If you mean it's WMD, that was done by tricking the west by proclaiming that Iraq was going to be using chemicals used in WMD for non WMD uses.
>What, 40 years of trade reliance didn't give you the insight into Xi Jinping you needed?
You are correct that the west took a blind eye to the geopolitical goals and ambitions of China, however it started as a strategy in the cold war (counter balance to the USSR) to the naive view that trade of libertarians that free trade makes geopolitical interest go away and peace comes in.
The data offers a fairly comprehensive and interesting perspective on China's research priorities and organization, I can't speak to the effectiveness of the programs themselves, but it does make me concerned that we are falling far behind in many areas, including cyber security.
[0] https://www.misp-project.org/
[1] https://raw.githubusercontent.com/MISP/misp-galaxy/refs/head...
[2] https://www.layer8.org/8541dd18-ff05-4720-aac7-1bd59d3921dd/