Feeds

US bill prohibits state use of tech linked to Chinese government

Has anyone on Capitol Hill heard of the global supply chain?

Application security programs and practises

In one of the first clear signs of a tougher stance on China, a new US spending bill has banned government agencies from buying any technology from companies thought to be “owned, operated or subsidised” by the People’s Republic.

The Consolidated and Further Continuing Appropriations Act of 2013, signed by president Obama on Tuesday, only pertains to non-defence government spending up until the end of the fiscal year on 30 September, but could be a sign of things to come.

The key passage, Section 516, prohibits the Commerce and Justice departments, NASA and the National Science Foundation from buying any IT systems “produced, manufactured or assembled” by any organisation which is “owned, operated or subsidised” by Beijing.

The only exceptions are if a piece of technology is deemed to be in the national interest, or if, after consulting the FBI, there is thought to be no risk of “cyber-espionage or sabotage associated with the acquisition of the system”, AP reported.

The rhetoric has certainly been ramping up on the US side since a House of Representatives Intelligence Committee report recommended Shenzhen telecoms kit makers Huawei and ZTE be locked out of the US market because they represent a national security risk.

That was followed with several high profile hacking attacks on US media groups, allegedly traced back to Chinese groups, and then the motherload – the Mandiant report, which detailed a direct link between the PLA and attacks on the New York Times and other US firms.

President Obama himself even went on TV to confirm the US is engaged in “tough talks” with China over state-sponsored attacks.

It’s unclear how much progress can be made in such talks when the official Chinese line is that it doesn’t condone hacking and that it is very often the victim, especially from attacks launched from US servers.

It also may be pretty difficult, given the global nature of the IT supply chain today, for government agencies to follow Section 516 faithfully.

Many if not most US technology companies, for example, have components produced, manufactured or assembled in China or by Chinese firms, so these will all need checking out if these firms are government suppliers.

Huawei said as much in its response to the Committee report:

Almost every ICT firm is conducting R&D, software coding and production activities globally; they share the same supply chain, and the challenges on network security is beyond a company or a country.

The problem then comes in trying to ascertain if said firms are “owned, operated or subsidised” by Beijing.

The House of Representatives Committee reported several times in its findings that it was unable to get the level of information required from Huawei and ZTE to allays its concerns over links to the Chinese government or Communist Party, so it’s unlikely that a US government agency is going to succeed where this detailed 11-month investigation failed. ®

Designing a Defense for Mobile Applications

More from The Register

next story
Sit back down, Julian Assange™, you're not going anywhere just yet
Swedish court refuses to withdraw arrest warrant
UK Parliament rubber-stamps EMERGENCY data grab 'n' keep bill
Just 49 MPs oppose Drip's rushed timetable
MPs wave through Blighty's 'EMERGENCY' surveillance laws
Only 49 politcos voted against DRIP bill
EU's top data cops to meet Google, Microsoft et al over 'right to be forgotten'
Plan to hammer out 'coherent' guidelines. Good luck chaps!
US judge: YES, cops or feds so can slurp an ENTIRE Gmail account
Crooks don't have folders labelled 'drug records', opines NY beak
Delaware pair nabbed for getting saucy atop Mexican eatery
Burrito meets soft taco in alleged rooftop romp outrage
British cops cuff 660 suspected paedophiles
Arrests people allegedly accessing child abuse images online
LightSquared backer sues FCC over spectrum shindy
Why, we might as well have been buying AIR
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Mobile application security vulnerability report
The alarming realities regarding the sheer number of applications vulnerable to attack, and the most common and easily addressable vulnerability errors.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.