GCHQ's cyber arm report on Huawei said to be burning hole through UK.gov desks

Britain is all a-tizzy about Huawei again as talk swirls over the imminent release of an unofficial report into the Chinese company’s influence over prominent Britons and a ban on its telco equipment. The volume of industry chatter was turned up to 11 this week after newspaper reports that a controversial former MI6 spy had …

[Jellied Eel]

Re: Can't have the Chinese take over from US spying, old chap

Is vulnerability testing the same as counter espionage testing/analysis ???. I would have thought the latter required detailed investigation of the hardware from a physical perspective. If the product uses home grown/designed silicon, then detailed physical analysis is a must ?

Depends. If the silicon's to be installed in a basement guarded by leopards, perhaps not. Otherwise it's assuming TBTB's pen/vulnerability testing teams are as good, if not better than academic/commercial or private testers. So kind of an infinite monkey scenario.. there'd be far more non-PTB eyeballs looking for bugs, and perhaps the only advantages the official ones have would be an ability to lean on vendors for help if they needed to.

I'm curious exactly what you'd need to be really sure and spot stuff like a carefully crafted packet on a public interface sneakily switching a device into pwn mode.. Which still happens more often than it should. And you'd have to retest whenever there's a firmware or system update.

[Anonymous Coward]

Re: Can't have the Chinese take over from US spying, old chap

"Vendors (or users) can submit kit/designs to GCHQ/CESG for evaluation, and sometimes that's necessary before it can go live, ie in high security applications."

The recommendation is to go beyond that though - they basically want a reference model for every telco that anyone can have a whack at.

"Hence, as raised in the DCMS Supply Chain Review, the NCSC recommends building a 'National Telecoms Lab'; a single location housing representative, operational examples of each of the UK's critical next-generation telecoms networks. The lab will be a bookable, accessible research facility, allowing teams from academia, SMEs, critical industries and government to research, test and learn about security on the UK's telecoms networks. The lab will also be a secure facility, protecting the UK operator’s IP and network information, as well as any vulnerabilities found by researchers"

https://www.ncsc.gov.uk/files/Summary%20of%20the%20NCSCs%20security%20analysis%20for%20the%20UK%20telecoms%20sector.pdf

[Jellied Eel]

Re: Can't have the Chinese take over from US spying, old chap

The recommendation is to go beyond that though - they basically want a reference model for every telco that anyone can have a whack at.

Not every, just the critical ones. Which would mean defining those, and then presumably excluding the others from supplying any services that might be deemed critical. Which I guess could end up being used as an incentive to co-operate, especially if it doesn't get funded and the burden then falls on industry.

But it'd get expensive. So figure on BT.. a reference model would be needed for every service configuration offered by Openreach, Wholesale, Business, Retail, and possibly Global, if that's still a thing.. Which would mean a large pile of tin + OSS/BSS used to drive it.. And then probably some staff to make sense of all that. And then the same again for every other operator. And then it'd need processes to either match operational versions, or maybe a planning window where planned changes or patches can be evaluated prior to rolling those live.

[amanfromMars 1]

Wanted Urgently ....... Another Bletchley Park Type Colossus Program*

"Hence, as raised in the DCMS Supply Chain Review, the NCSC recommends building a 'National Telecoms Lab'; .. .... Anonymous Coward

Does one not already exist ? ......

In November 1975 Her Majesty Queen Elizabeth II formally opened BT's global research and development headquarters as a new centre for telecommunications research. Today it has grown to become Adastral Park. ....... https://atadastral.co.uk

* A challenge and bridge too far for the UKGBNI Governments [the Gang of Four] methinks ..... but not necessarily so for a Few and A.N.Others in the Private and Pirate Sectors of Life and LOVE ..... the Live Operational Virtual Environment.

[David Shaw]

Re: Wanted Urgently ....... Another Bletchley Park Type Colossus Program*

AMFM1 you mean GPO Martlesham heath , not a half rendering of the latin "to the stars" , missing off the "ardua" - by hard work... I've never heard anyone actually call it adastral

there are (about) seven experienced telco jobs available there, one of which suits me nicely, but Ipswich? https://www.innovationmartlesham.com/contact/job-vacancies/

(the National Telecoms lab that I was trained at had around 300 apprentoids at any one time, but as others mentioned above, the very wealthy manglement was more interested in race-horses than real things)

I met many martlesham seriously spooky GPO engineers working openly with the deeply spooky gov comms wonks in the various telecom standards setting groups, all serious, sensible chaps. keep up the good work.

however, some worrying data.....as Boots stores are closed around the country

http://career.huawei.com/reccampportal/portal5/social-recruitment.html?jobFamilyCode=&countryCode=#jobList

so a quick check, Huawei is recruiting 41 experienced telco people, for EU

+ 5-overseas Chinese graduates for Asia etc

+ 46-international telco type graduates

so seems to be approx 97 interesting jobs in Huawei versus rather a lot less in the UK (I managed to find another 5 engineering jobs for BT themselves, in UK)

anyway, if I was looking for a career, with a shiny new degree in telco, Huawei looks a bit more interesting than adastral park & their close to 'zero' salary

https://bt.taleo.net/careersection/pfengng/jobdetail.ftl?job=140048&tz=GMT

(salary to be the network ops engineer between UK & Dublin, is apparently, zero) sigh

[NeilPost]

Re: Can't have the Chinese take over from US spying, old chap

There isn’t any US gear which is part of the problem: carrier grade 5G is Huawei, Nokia, Ericsson or Samsung. All the US companies went bankrupt and were flogged off to one of the above.

Cisco make networking kit, not cell Phone tech..

[JetSetJim]

Re: Can't have the Chinese take over from US spying, old chap

Minor correction, Cisco have attempted to buy their way into the cell phone tech market. Acquisitions I'm familiar with are:

a) Ubiquisys - a $400m failure to buy into the small cell market, attempting to piggy back their wifi into them

b) Starent - a core network equipment vendor - I'm not entirely sure of the status of that

At one time Cisco was a supplier of GGSN's (and possibly SGSNs too) for the packet data core network of a mobile network, which are basically carrier grade routers with some extras on top implemented in s/w. No idea if they have updated their offering into the LTE and 5G domains, and I've no idea how successful they were in the earlier G's.

True, though, that the "raw" mobile network kit are those companies, and they've swallowed or killed others such as Alcatel(-Lucent), Motorola & Siemens, and there are other minor players out there

[Anonymous Coward]

Chinese ambassador: "Britain can only be great when it can have its independent foreign policy."

Couldn't agree more, old chap ... now would you like to hear some more about our independent foreign policy position on Hong Kong [1]... :-)

[1] Other suitably independent foreign policy positions are available.

[martinusher]

Re: Chinese ambassador: "Britain can only be great when it can have its independent foreign policy."

>now would you like to hear some more about our independent foreign policy position on Hong Kong

Hong Kong is part of China. It enjoys a good bit of autonomy from China proper but its only in the same sense that somewhere like the Isle of Man is an idendpendent part of the United Kingdom.

The laws that the Chinese have extended to Hong Kong are not unlike those UK Terrorism Act laws under which four people were arrested a couple of days ago. (If you're unfamiliar with this act then its worth looking up a summary in Wikipedia or similar -- I'd guess that any parrly or externally funded group in the UK that was formenting violence or serious damage to property would would be named as a prohibited group.)

[Version 1.0]

Time to take a step back.

The solution to all these problems is to return to the days when we built our own gear instead of trying to buy it on the cheap from some other country. Buying cheap foreign telecommunications gear killed the UK telecommunications industry, resulting in engineers loosing their jobs while the people owning the companies selling the "cheap" phones started buying themselves an island or two in the Caribbean.

[Anonymous Coward]

Re: Time to take a step back.

The move away from engineering excellence in the UK telco's into project management, was a decision based on implementing an upgraded network as soon as possible, to make as much profit as possible (hence pay higher dividends).

The UK's attitude has always been detrimental to engineering roles. The wholesale copying of western technology etc., has allowed products from the far east to be much cheaper, and hence profit margins higher in the west. The loss of skills from the west isn't seen as a problem, as with the governments of today and the past, we can buy it in, and discard it when necessary.

People and their skills seem to have become fodder, here in the UK.

[KBeee]

Re: Time to take a step back.

The UK Gov and companies attitude for many years has been "Why make/produce something expensively here, when we can buy cheaper from abroad?" ignoring the fact that the expensive part (wages/salaries) will now have to be supported by the taxpayer as unemployment benefit etc. It even makes sense if you can say that your carbon footprint has been vastly reduced by exporting your manufacturing and production. The next Big Idea to meet Government promises about becoming carbon neutral is "If we stop producing food here, and plant trees instead, we can meet our carbon reduction promise." This was given pause by Covid-19 showing how important locally produced food is, but no doubt it will be back on the agenda soon. And it's easilly done, just reduce farm support to your local farmers so it becomes economically unviable to produce local food, and instead buy your food from farmers abroad that do enjoy being subsidised by their government (all of Europe and N America for instance). Might have to lower our food standards -chlorinated chicken anyone?- but Hey look how Green we are now! We exported our pollution again to look good.

There is a petition going to keep UK food standards up to the level we enjoy now - https://www.campaigns.nfuonline.com/page/56262/petition/1 - which I emplore you to sign.

If you want to see a farmers view on this, see Harry Medcalf with his Farmers hat on, instead of Petrol Head hat - https://www.youtube.com/watch?v=7e6lR8R82Ec - and watch from about the 15m 30s mark.

Sorry for a bit of a rant, but idiotic decisions by our "Leaders" get my goat. Can you imagine France or Italy doing anything so idiotic as closing down their farms just to basically Virtue Signal the rest of the World for no point?

[Doctor Syntax]

Re: Time to take a step back.

"Can you imagine France or Italy doing anything so idiotic as closing down their farms just to basically Virtue Signal the rest of the World for no point?"

Given their rural votes they wouldn't dare.

[JetSetJim]

Re: Time to take a step back.

Buying cheap foreign X always kills the domestic X industry.

[Pascal Monett]

"your image as a country that can conduct independent policy"

Um, which country are you talking about again ? Germany ?

Because the UK has been subservient to the White House for ages now. It has the policy the USA agrees with.

[steelpillow]

Hong Kong

The elephant in the room now is Hong Kong. China's new law has made everything to do with China political. Whatever the HCSC's technical findings, China will not be giving Huawei many options from here on in and Huawei's assurances of good faith are as rock-solid as China's treaty with the UK turned out to be. The only question is, is it better for Hong Kong if we stand up and offend the oppressor into taking revenge that shocks the world, or to accept a commercial advantage in the hope of a quieter transition to Chinese assimilation?

[Rick Jansen]

Belgacom remembers GCHQ, and so do we

I understand the UK is worried about snooping by China. Not that it has ever been detected in any equipment from Huawei that I know. On the other hand, the UK’s GCHQ has actively hacked Belgacom a few years ago. A European ally. So who can you trust these days? Well?

[Anonymous Coward]

Id trust huawei more than an american alternative. We may have unsusbtantiated concerns over Chinese involvement, but we have decades of evidence of US snooping. "Dont let them steal your privacy, let us do that instead".

[martinusher]

We gave away the farm but still expect the farmer to do our bidding

The only significant issues with Huawei is that its successful, Chinese and its not providing a profit flow for the usual financial players (its an employee owned company). Of these sins the third is probably the gravest because a corporation that's not generating raw material for the financial engineers of this world is not playing the game. By not participating its not just depriving the bankers of their just rewards but its also making a more efficient business model that's difficult for a regular corporation to compete with.

There are other companies that aren't Chinese that don't play the corporate financial shell game whcih grow very efficient and profitable. You'll notice that eventually they'll be calls for them to be broken up 'in the public interest'. My epxerience has been that its rarely been in the public intrerest, the real beneficiaries of this are the bankers with the customers always ending up on the losing end.