None of America's allies have chosen to "go through the expensive and long process of owning the entire stack" - America's allies use Windows, Android, Qualcomm, Intel, etc.
If China really does want it's own home-built silicon running it's own written-at-home operating systems, they need decades and they'd just replicate what Microsoft or Google have done to date (and probably less well.) I don't doubt that the CCP do want that independence from American technology, but to truly be independent is really quite an extreme proposition.
As for silicon China doesn't have much choice in the matter. Their dependence on American silicon may in fact be their greatest security risk. It's clear that the US and its allies will weaponize this advantage (see Stuxnet) so anybody relying on these chips is ultimately at their mercy.
Please elaborate on this point, my understanding is Stuxnet relied purely on software vulnerabilities (to spread and to take control of the centrifuges). I don't think it used any hardware backdoors or anything. If it did, I'd have expected the roar to be enormous, probably several times what we just had with Spectre/Meltdown.
But that's not a hardware attack. IIRC, Stuxnet used driver signing certificates to bypass some OS-level safeguards. It's quite possible that the needed certificates were stolen from a manufacturer that poorly protected them.
When you said:
>> Their dependence on American silicon may in fact be their greatest security risk. [emphasis mine]
The implication is that American silicon itself is backdoored. That may be true, but I don't think Stuxnet is in any way an example.
There was no such implication. Compromising hardware never makes sense unless you can intercept the hardware en route (something the NSA has been known to do [1]).
> It's quite possible that the needed certificates were stolen from a manufacturer that poorly protected them.
It's also possible that unicorns exist. Considering that certificates have been "stolen" from Taiwanese firms multiple times [2] I'd say it's not irrational to consider the possibility that these firms either are directly or via the Taiwanese government cooperating with US cyberattacks.
All of this indicates that yes, relying on such foreign chipsets is huge security threat. China imports an incredible $200 billion a year in such chips so even putting aside the huge technological attack surface associated with such a dependency the dependency constitutes an immediate economic vulnerability.
[1] https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...
[2] https://www.wired.com/2015/06/foxconn-hack-kaspersky-duqu-2/
But to be totally clear: that's no more than speculation.
It's also not irrational to consider the possibility that there's been no cooperation but that the certificates were stolen.
> It's also possible that unicorns exist. Considering that certificates have been "stolen" from Taiwanese firms multiple times [2]
Malware that uses stolen certificates is less unique than once thought. If a group building a bank trojan can steal certs, I'm sure state intelligence agencies can too.
https://arstechnica.com/information-technology/2017/11/evasi...
There is also some reason to think their certificates would be targeted for theft, because code signed by those firms would be some of the least conspicuous. There are a lot of Taiwanese firms that make a lot of low-profile specialized support silicon that's literally everywhere (Sound, USB, Wifi, etc), and a driver signed by one will arouse less suspicion. Inconspicuousness would be a high priority for a nation-state hacker trying to avoid detection.
The possibility that the Stuxnet and Duqu certs were stolen is speculation too, but it's less inflammatory and more likely in my judgement.
It's also worth noting that getting explicit cooperation from a company to use their certificate would be risky for clandestine nation-state operation, since the more organizations that know about aspects of it, the more likely it will fail. If word got out that a particular code signing cert was shared, a rival actor could focus attention on suspicious code signed by that cert and be more likely to detect it.
>> The implication is that American silicon itself is backdoored.
> There was no such implication. Compromising hardware never makes sense unless you can intercept the hardware en route (something the NSA has been known to do [1]).
That's wrong. If the silicon is comprised from the get-go, there's no need for an interception step.
But corruption & income inequality exist in China as well. Depending on how you measure China has waaaay worse problems in those areas than the States do.
I suspect this will be a big problem for existing chip makers in the long run. Chinese chip makers will happily attack the fat margins that exist today and will offer (quasi-subsidized) prices that will prove irresistible elsewhere.
[1] http://nationalinterest.org/feature/how-china-will-benefit-a...
[2] https://www.bloomberg.com/news/articles/2018-03-01/china-is-...
I am so used to hearing what is basically propaganda in our press about how much better we are than the rest of the world, that now articles like this inspire scepticism.
Our country (USA) does indeed have a lot of advantages with: technology and geographic isolation.
But we also have problems in income inequality and increasing corruption in our political system (Clintons, Trump, etc., etc.)
I really like the ‘Sputnik’ analogy because just as my country had an ‘oh shit’ moment when we realized we were behind, I expect the Chinese to go through the expensive and long process of owning the entire stack, micro chips, and up.