Huawei: 'trust us, we are being transparent'

In an environment that's increasingly hostile to Chinese tech companies, Huawei has put forward its case for attitudes to be revised.

Speaking to the CeBIT Australia conference in Sydney, the company's global cyber security officer John Suffolk said there's little difference between Huawei and any other major vendor: its products come from a host of suppliers in a huge number of countries.

Seventy percent of the hardware found in Huawei's equipment comes from outside China, Suffolk claimed, and 32 percent of it comes from American suppliers. A similar tale can be told for software, he said, with contributions from around the world.

“We go, as all companies do, to where we can find the best researchers, the best talent around the world,” he said. “We go where we have talent, where the economic conditions are right.”

He described relocation of operations to follow services as “a core competency of every company”, something which underlines the need for any vendor to treat security as a global issue that flows all the way through every supply chain.

Noting that the world contains many, many places where any product could be compromised, he added that it's easier in general to bribe an insider than to launch a concerted and successful attack from the outside.

He also called on customers – particularly governments and large enterprises – to be far more activist in what they demand form vendors.

“If you, as governments or large enterprises, don't say to your vendors 'this is what good security looks like', don't expect the vendors to do anything about it,” he said.

He said that “highly variable” responses from vendors are an indication that they don't have good security procedures in place, but rather are “making it up as they go along”. Such are the opportunities to compromise a product, in a global supply chain, that no vendor can offer secure products “unless you have repeatable, standard processes.”

Transparency, he said, is vital to security and information assurance, and he claimed that Huawei is “the most audited company in the world … we can trace 96 percent of all our components, except non-tech things like cables and batteries”.

Customers should ask vendors “can you trace everything from a requirement through to code and back again?” Suffolk added.

“We welcome being audited, inspected, poked and prodded and probed,” he said. ®