Feeds

Huawei, ZTE probe showed no evidence of spying

All they did was sell lousy equipment

Combat fraud and increase customer satisfaction

An 18-month investigation by the US House Intelligence Committee into Chinese networking vendors Huawei and ZTE revealed no evidence that either company has been involved in espionage, sources claim.

As reported by Reuters on Wednesday, two sources familiar with the probe said that "certain parts of government really wanted" to uncover evidence of spying, adding, "We would have found it if it were there."

That lack of evidence didn't stop lawmakers from issuing a stern warning to US companies, however, arguing that doing business with either Chinese vendor could pose a security threat.

Earlier this month, Intelligence Committee chair Mike Rogers said, "China is known to be the major perpetrator of cyber espionage, and Huawei and ZTE failed to alleviate serious concerns throughout this important investigation. American businesses should use other vendors."

But according to Reuters' anonymous sources, those "serious concerns" weren't much more than hunches. Not only did the Congressional probe fail to link Huawei and ZTE to current spying activities, but it found no evidence that either company had engaged in espionage in the past.

Rather, the Intelligence Committee made its recommendation based on "a general sense of foreboding" about what might happen if the Chinese government asked network equipment vendors to help gather intelligence from US customers, according to former CIA analyst Chris Johnson.

That foreboding may have been seeded, at least in part, by the Chinese vendors' US-based competition. Last week, The Washington Post claimed to have uncovered a Cisco marketing document that painted Huawei as a security risk, using language very similar to that found in the Intelligence Committee's report.

When asked directly during whether ZTE took orders from the Chinese government, however, Zhu Jinyun, the company's senior VP for North America and Europe, was insistent.

"The committee's central question has been: would ZTE grant China's government access to ZTE telecom infrastructure equipment for a cyber attack?" Zhu told the Intelligence Committee. "Let me answer emphatically: no! China's government has never made such a request. We expect the Chinese government never to make such a request of ZTE. If such a request were made, ZTE would be bound by US law."

Huawei also denied that it took its orders from the Chinese government, but as with ZTE, its protests seemed to fall on deaf ears. Shortly after Rogers issued his advisory to US companies, Huawei issued a statement accusing the Committee of being "committed to a predetermined outcome."

Bugs, just not the spying kind

But although the Congressional investigation did not turn up any evidence that Huawei and ZTE were engaged in spying, it did reveal other reasons why customers might choose to avoid equipment made by Chinese vendors, sources say.

The Intelligence Committee's investigation into the security of Huawei's router software reportedly found it "riddled with holes," many of which could potentially be exploited by hackers. One expert told Reuters that it was "five times easier" to find a security vulnerability in a Huawei router than a Cisco one.

Those defects didn't seem to have been put there intentionally or maliciously. Rather, they seemed to be the result of ordinary sloppy coding. So it seems Huawei and ZTE customers do run a greater risk being targeted by hackers, after all; just not necessarily by Chinese spies. ®

SANS - Survey on application security programs

More from The Register

next story
Android engineer: We DIDN'T copy Apple OR follow Samsung's orders
Veep testifies for Samsung during Apple patent trial
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Did a date calculation bug just cost hard-up Co-op Bank £110m?
And just when Brit banking org needs £400m to stay afloat
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Don't let no-hire pact suit witnesses call Steve Jobs a bullyboy, plead Apple and Google
'Irrelevant' character evidence should be excluded – lawyers
EFF: Feds plan to put 52 MILLION FACES into recognition database
System would identify faces as part of biometrics collection
Ex-Tony Blair adviser is new top boss at UK spy-hive GCHQ
Robert Hannigan to replace Sir Iain Lobban in the autumn
Alphadex fires back at British Gas with overcharging allegation
Brit colo outfit says it paid for 347KVA, has been charged for 1940KVA
Jack the RIPA: Blighty cops ignore law, retain innocents' comms data
Prime minister: Nothing to see here, go about your business
Banks slap Olympus with £160 MEEELLION lawsuit
Scandal hit camera maker just can't shake off its past
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.