> " This argument would hold more weight if the government was saying not to use any non-US phone"

There's not even such a thing as a "US phone" though, is there? Even phones manufactured by US companies like Apple are made in China with Chinese/Taiwanese sourced parts. Google always outsources its Nexus/Pixel devices to third parties like LG and Motorola. Speaking of Motorola, they are now owned by Chinese manufacturer Lenovo, which has also been in hot water lately over spyware and rootkits in their laptops.

I'm of two minds about the announcement. On the one hand, Huawei and ZTE have both been caught installing backdoors and spyware on their devices in the past[1]. On the other hand, the US three letter agencies have a vested interest in US citizens carrying around easily monitored and tracked devices, and they easily find ways around Constitutional protections against spying within their own borders.

I honestly don't know who to believe in this situation.

[1] https://www.fastcompany.com/4025254/new-phone-who-dis-huawei...

"Even phones manufactured by US companies like Apple are made in China with Chinese/Taiwanese sourced parts."

Exactly my thought. US gov't even outsources to private contractors that then subcontract and outsource to China for electronic components including chips that can easily end up in our DOD systems. I wonder if this is more of a money or market thing being pushed by the Existing Oligopoly?

Something doesn't appear to add up completely?

What doesn't add up is that, in the real world, you can't protect against every threat model. Its their job to protect the best they can. They can't tell Apple to stop building their phones in China, but they can simply say "Don't buy Huawei".

That's easy. And moreover, its a bigger threat. With a Huawei phone, the Chinese government has control over everything from the processor to the userspace software. With a small piece of silicon in a fab, the threat surface is much smaller; they'd have to sneak it in against Apple's will, past all of Apple's American-loyal QA.

In the software world, we tend to think about security as an absolute, because computer logic is absolute. In the real world, security is probabilities. How can you minimize the chance of breach while minimizing costs.

>they'd have to sneak it in against Apple's will, past all of Apple's American-loyal QA.

Is Apple's QA workforce mostly American or do they have a lot of Chinese H1Bs? I mean loyalty is a fickle thing.

>What doesn't add up is that, in the real world, you can't protect against every threat model. Its their job to protect the best they can. They can't tell Apple to stop building their phones in China, but they can simply say "Don't buy Huawei".

If the 'threat' was real, that makes as much sense as hardening one door in your house, when you have 4 other doors because "you can't protect against every threat model".

No. It makes as much sense as securing the 4 doors because that's a relatively cost efficient way to implement basic security. But let's avoid strengthening all the walls with a titanium alloy to protect us when the threat brings a bulldozer to get in. That's expensive.

Asking Apple to manufacturer their phones outside of the US is a highly expensive action.

And the pictures of NSA employees opening parcels to modify the hardware before it gets shipped to certain targets immediatly comes to my mind.

That being said if you don’t control the software, modifying manually a handful of devices doesn’t scale. If you modify all of them the chance that you will be spotted is very high. If you control the software and it is encrypted / not readable, you can backdoor all devices of a whole country. So I can see how it is a step up in term of threat level.

Not sure why this was downvoted. Those pictures are right here:

https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...

If Huawei and ZTE put in back doors, and the CIA/FBI/NSA wants into your phone, then you'd expect they would want you to have a Huawei phone. After all, as oft repeated here, a backdoor is accessible to anybody, no matter who it was put in for.

Not necessarily. If there is a hardware vulnerability specified by the Chinese government, the NSA would not want you to use that phone. They'd rather keep China from having the easy option and then compromise your info another way (that presumably makes it more difficult for China to get your info).

Also, finding the backdoor is still some effort.

> There's not even such a thing as a "US phone" though, is there?

BLU?

No. Their phones are rebranded devices manufactured in China. I'd also steer clear.[0][1]

[0] https://www.kryptowire.com/adups_security_analysis.html

[1] https://www.bitsighttech.com/blog/ragentek-android-ota-updat...

Samsung is South Korean, a US ally and SIGINT partner. Modify the argument to, "the government is saying not to use any phones that are not from the US or its puppet states."

Are Huawei and ZTE the only phone manufacturers from a non-SIGINT partner state? That doesn't seem correct. Hell, https://en.wikipedia.org/wiki/List_of_mobile_phone_makers_by... lists 29 different mobile phone makers in China, 2 of which are Huawei and ZTE, one of which is a subsidiary, leaving 26 independent manufacturers. But the government isn't telling us not to buy e.g. a Xiaomi phone.

Which of those other 27 are big enough in the US to be worthy of mention?

How about Xiaomi? Wikipedia says that as of 2017 they're the world's 5th largest smartphone company. I don't know how popular their products are in the US, but I have at least heard of them before (which is more than I can say for ZTE).

I’d venture to say 98% of the US population couldn’t tell you if Xiaomi was a tech company or a Chinese food dish.

Considering that the name literally means little rice, they wouldn't be necessarily wrong. (at least it isn't 小蜜, which has a different meaning...)

That's true of Huawei and ZTE too, and yet the government thought it was worth saying don't buy their phones, so I'm not sure what your point is.

My point is that Xiaomi phones are not popular in the US, at all. Xiaomi had zero official distribution in the US up until recently when they started selling directly on amazon. ZTE and Hauwei phones have been sold through official distribution channels for a while. ZTE phones are given away or nearly given away for free to every cricket wireless customer.

I am more aware of Xiaomi than Hauwei. ZTEs were around, but those are garbage phones. I know that Xiaomi makes phones, smart bands and a smart tv. I literally had no idea what Hauwei was making until I looked up right now.

Huawei made one of the Nexus phones.

FYI, Xiaomi is very popular in India, because they offer perceived good value for the cost.

Xiaomi now has the largest market share amongst phone manufacturers in India.

Xiaomi has almost zero presence in the US market, you can't get their phones here unless you go via a grey market importer.

Or Amazon.com...

The witnesses only answered the question in front of them. Sen. Cotton only asked about ZTE, Huawei, China Telecom, and China Unicom, so Director Wray responded only about ZTE and Huawei. This is standard practice when testifying in front of an oversight committee.

What about OnePlus then? It is a Chinese company, and I'm sure they sell more phones than Huawei.

Calling South Korea a puppet state is quite a stretch.

Even if it was a puppet state, apparently Samsung is above the law there. They are like 70% of its GDP.

You're thinking of all of the chaebol/conglomerate companies combined, so Samsung, LG, Hyundae Kia, Posco, Hyundae Heavy Industries, SK Group, CS Group, Lotte, Hanhwa, Hanjin, Kumho Asiana, Doosan, etc., each of which have multiply companies in their portfolios and are serviced by groups of smaller local firms specialized in support for one or a few of the big ships.

But, do they feel above the law? This is certainly a common complaint of South Koreans. These groups are definitely "too big to fail" and they know it. So yes the concentration of power in a few giant firms is remarkable, and not in a good way.

1/5th of exports, 17% of GDP.

https://en.wikipedia.org/wiki/Samsung

I stand corrected. I shouldn't try to pull statistics from my failing memory anymore. Still big enough to intimidate a government from messing with them.

> Still big enough to intimidate a government from messing with them

Nope, per recent incidents.

Um, well Samsung's president hass been released from jail, but the countrie's last president hasn't... http://fortune.com/2018/02/05/samsung-j-y-lee-released-south...

I'd say that is a LOT of influence.

Released from jail necessarily implies the government will "mess" with them.

An important Samsung person was arrested and promptly released. That is not how a government messes with a company. Tax. Regulations. Things that hurt the bottom line constitute 'messing'.

The United States maintains wartime control of the South Korean military (look up OPCON to find news about the topic).

And their argument would hold more weight if they would just point at the vulnerability they're suspecting.

Even if they only had rough suspicions (with rigorous technical underpinnings, just like a security researcher taking their job seriously). The public security community has repeatedly discovered, reported and fixed serious security vulnerabilities without the NSA doing shit all to help out (which is their job) whether they knew about the vulnerability or not, going as far as deliberately pushing back.

The only reason I can see why you'd prefer one argument over the other is if you somehow believe the NSA always has the best interest of the people at heart. But I think we know a little better by now and they might support the people in theory, but there are usually other interests that are bigger and better and more important.

Do you really expect the FBI, CIA, and NSA to point to a specific vulnerability? I would imagine their specific concerns are classified due to national security.

If it was just the NSA saying this I'd be a bit more skeptical. But if the FBI and CIA agree, that seems like sufficient reason to believe that their motives are honest.

The US has a closer relationship with South Korea's security apparatus than China's, though.