No ‘smoking gun’ evidence coming on Huawei, NSA official says

Don’t expect U.S. officials to produce a “smoking gun” of public evidence that the Chinese government might be using telecommunications giant Huawei to further its interests in cyberspace, a senior National Security Agency official told CyberScoop.

“Everybody is anxious for that smoking gun,” Rob Joyce, senior cybersecurity adviser at NSA, said in an interview. “It is not the case that you’re going to see people bring out and drop that smoking gun on the table … for all sorts of reasons about the way we understand the threat, the way we deal with the Chinese, the way we have to protect the ability to see and maybe defeat or deny that capability going forward.”

U.S. officials have long accused Chinese tech companies Huawei and ZTE of being potential vessels for spying. One reason is that under Chinese law, companies are required to cooperate with national intelligence activities. Huawei and ZTE strenuously deny the allegations, saying they operate as competitive companies in the global economy.

Huawei founder Ren Zhengfei has said he would sooner “shut the company down” than spy on behalf of the Chinese government — a protestation that will do nothing to dissuade U.S. officials from publicly warning about the security threat they feel the company poses.

U.S. security concerns have only intensified as companies like Huawei — the world’s biggest maker of telecom gear — are positioned to play a big role in shaping the next-generation 5G mobile communications network. The technology promises more rapid data transfers and greater connectivity and, as can be the case with new tech, potential security headaches.

Beyond espionage

With the coming widespread deployment of 5G, Joyce said he was more concerned about Beijing using telecom gear to create a cyber “effect” than to conduct espionage. “It could be an attack,” Joyce said, adding: “It could be subtle manipulation” of a network.

“It’s not just about espionage or the confidentiality of our secrets and our information,” Joyce said. “It is about the things that are going to run on the 5G network. I worry that when somebody wants to have an effect, whether it’s the Chinese or somebody else, that we make sure we’ve considered that in the way we’re architecting to make it strongly defensible and resilient.”

He likened allowing extensive Chinese development and design of the 5G network – and the knowledge of potential vulnerabilities that comes with that – to “asking the burglar to build your house.”

In a separate interview, Chris Krebs, a senior Department of Homeland Security official, said 5G will change how network defenders have to think about cybersecurity risk.

“You’re talking about throughput, low latency, speed,” said Krebs, the director of DHS’s Cybersecurity and Infrastructure Security Agency. “It’s not about confidentiality and espionage,” he added, but rather the availability and functionality of devices on the network.

If 5G networks are designed and deployed insecurely, multiple countries could look to exploit that, Krebs told reporters Tuesday at the RSA Conference in San Francisco. “This is not about one country; this is not about one company,” he said.

The standoff between Washington and Beijing over Chinese tech companies has escalated significantly in recent months with the arrest of Huawei CFO Meng Wanzhou in December at the request of U.S. officials. Canadian authorities last week agreed to proceed with an extradition hearing for Meng, who is charged with fraud and violating U.S. sanctions.

On Wednesday, Huawei sued the U.S. government, alleging that a U.S. law prohibiting government agencies from buying Huawei equipment or working with companies that do violates the Constitution.

‘We’re shocking the system’

Krebs and Joyce used RSA, one of the biggest cybersecurity conferences in the world, to single out Chinese hacking as a significant threat facing the United States.

Among other factors, China’s global reach and its development of technical capabilities, “brings them to the front of the list” of U.S. adversaries in cyberspace, Joyce told reporters Tuesday.

In recent months, U.S. prosecutors have announced multiple indictments of alleged Chinese state-sponsored actors for allegedly stealing U.S. intellectual property.

Krebs told CyberScoop that private executives he had spoken with on the sidelines of RSA were listening closely to U.S. government warnings about Chinese cyber activity.

“We’re shocking the system a little bit because we haven’t been this vocal,” Krebs said.

He said that it would help drive home the risk to corporate networks if DHS points to use cases in which a company lost both proprietary data and market share because of Chinese hacking.

“The general reaction from private sector partners is one of significant concern and they want to know more,” Krebs added.