1

The BBC News article Huawei says willing to sign 'no-spy' agreements reports the following:

Huawei has also said it is independent from the Chinese government, but some countries have blocked it from their 5G networks on national security grounds.

A recent report suggested the UK could allow Huawei's telecoms equipment to be part of the country's 5G networks, with some limitations.

"We are willing to sign no-spy agreements with governments, including the UK government, to commit ourselves to making our equipment meet the no-spy, no-backdoors standard," (Huawei chairman) Liang Hua said via an interpreter at a business conference in London on Tuesday. (emphasis added)


Question: Does a "no-spy, no-backdoors standard" exist anywhere for telecom hardware manufacturing? Is there at least a proposed framework for one, or is this something new?

3

Given that there had been zero substantial evidence presented that Huawei's networking equipment was ever bugged to begin with, this looks like it's just translation issue.

The "standard" they're referring to is the contract/agreement they're signing, which is the de facto expectation with pretty much the sales and manufacturing of any such business networking equipment to begin with. A better translation would've been "expectation (of the contract)".

With consumer level equipments things becomes a lot fuzzier because of definitions issue. Many consumer equipments are self updating and some may collect analytics for troubleshooting purpose, which with some squinting could be interpreted as a backdoor and spyware. Self updates are generally a good thing and analytics is also not necessarily malicious, as it ensures that the equipments are up to date and patched from any security problems discovered after manufacture, but to some degree a self update feature is essentially also a backdoor as it allows manufacturer to push new software to the device.

  • This makes sense, thanks! – uhoh May 15 at 4:51
  • @uhoh Please do not forget to mark the answer as accepted if it answered your question sufficiently. – MechMK1 May 15 at 12:47
  • @MechMK1 I usually give a question like this at least a day to go around the Earth once. While the quote cited by the BBC may indeed contain a translation error, that doesn't mean that no such standards nor frameworks exist. – uhoh May 15 at 13:03
  • 1
    @dwizum: Pretty much any business relationship between large enterprises involves "due diligence". Large enterprises like Huawei aren't foreign to corporate governance and control standards like ISO 27000, which Huawei had been accredited with for a long time since 2004. This is really just business as usual for a large enterprises like Huawei. Huawei also offered concerned governments to inspect its products and processes. – Lie Ryan May 15 at 14:33
  • 1
    Note that some Huawei firmware was backdoored for their core routers, but as a result of US interference by the NSA, not the Chinese government. The same was (is) true with Cisco and Juniper. – forest May 16 at 0:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.