On: Britain knows it’s selling out its national security to Huawei

[unethical_ban]

Here's my biggest question of the whole thing:

  * Can governments not inspect the hardware themselves to see if there are physical backdoors?

  * Could they not, as a precondition for any provider, demand to see the source code of the radios?

  * If the ISPs tunnel the backbone traffic combined with more/most Internet traffic being secured anyway, 
 wouldn't that minimize data leaks?

  * If you admit that the previous point isn't valid because of metadata concerns, doesn't that invalidate the US
 national security establishment's position on metadata towards the public? 
 They have previously scoffed at such concerns ("It's only a phone number") but now it matters.

  * Wouldn't rogue equipment exfiltrating data be rather obvious?

[_jxdz → unethical_ban]

For points 1 and 2 at least, the UK has the Huawei Cyber Security Evaluation Centre where GCHQ can inspect all Huawei hardware as well as the source code, although it is run by former Huawei employees (overseen by GCHQ) so its independence is questionable.

[timthorn → _jxdz]

The staff are actively employed by Huawei, but all undergo UK security clearance to DV standard.

[hardlianotion → _jxdz]

I believe the centre cannot satisfy itself that the code they inspect is the code that is built into the hardware.

[gnfargbl → hardlianotion]

Yes.

...it is not possible to be confident that the source code examined by HCSEC is precisely that used to build the binaries running in the UK networks.

-- https://assets.publishing.service.gov.uk/government/uploads/...