I agree that general "All Chinese are spying on you!" is not a helpful message, but nation-state espionage, generally, is not a bad thing to be aware of overall. The article also doesn't seem to fear-monger so much as call out recent espionage attempts while also citing the difficulty of detection because most folks are here for the right reasons.

As for "leave it to the professionals", you left out a key component from your list - the people doing the work - doing the research, building the devices. Engineers, professors. The people doing the work are the first line for any social engineering or simple vector attacks. Anyone that works with this information reads and signs things but if they haven't really been tested or understand the consequences, maybe they forget.

Having a reminder that it's OK to be impolite when somebody you don't know asks you overly specific questions you're not supposed to share is not always a bad thing.

When I said "leave it to the professionals", I meant to cover the workers indirectly when I said "corporate security". Corporate security personnel shouldn't be getting operational info from popular press.

Agreed, but corporate security is also not out at the bar on a Friday. One would hope that facilities security folks would at a minimum be briefing people, but that stuff costs money, and probably doesn't happen as much as it should.

Would not anyone working in that sort of area not have been vetted and given guidance on what to look for.

I've found that people in many areas of work are given guidance and training then either: a) forget over time b) ignore the policy because they think they know better c) ignore the policy because it is inconvenient (this is my favorite!) d) ignore the policy because it is personally advantageous to them (either for reputation, money, etc)

Reminders never hurt (assuming they are reminders and not over the top bigoted screeds)

So many people think they understand what the impacts are if they bend some of these rules, or ignore them a bit for convenience. I would argue that most of the time, unless the stakes are consistently high, they do not.

Probably employing the wrong sort of people then.

I would hypothesize that every single medium to large organization has this problem. Anecdata confirms, but that's not data, obviously.

>diplomats, intel agencies, law enforcement, corporate security

Personally, I have absolutely no trust in any of these, and I completely disagree that we should "leave it to the professionals" and let them "handle discretely" whatever is going on. This is how you end up with things like FISA courts, Gitmo, and PRISM.

The article mentions that most are here for legitimate reasons. It seems like the headline could have had a better choice of words to be less of a blanket statement.

I'm uncomfortable about the fire, too. And I'd like to trust the firefighters to handle the fire, in this case. Not alarm non-firefighters, to go rushing in the way of firefighters, kicking in doors of houses that are not on fire, etc.

No one is advocating "kicking in doors of houses that are not on fire".

What should be done is to be aware of the risk, and that it is very different doing business with China vs. say, Thailand or Mexico.

Of course, wherever you do business, you must take precautions against IP theft and having your product sold out the back door.

However, for China, the threat model needs to be completely re-calibrated. Specifically, recalibrated to assume either that your product will be sold out the back door of the factory under another label, that your IP will end up in a competitor's hands, or that if it is important enough it will be expropriated by the govt either via rules requiring 'sharing' or by state-level espionage.

This is NOT to say that every person is untrustworthy. There are good people everywhere.

The difference is like that between a small rural town where everyone knows each other and leaves their doors unlocked and keys in the car, vs. a gang-ruled favela where you need to watch your back if you step outside. Both are mostly full of good & honest people, with a few problems, but you really need to calibrate your behavior differently for each.

> kicking in doors of houses that are not on fire, etc.

I don't follow your metaphor.

To hazard a guess, it should be up to to security/risk experts and the like to monitor and determine where the threats come from, set policies, and deny access accordingly. It shouldn't be up to citizen watchdogs to yank computers from people because they have a terminal up appear to be hacking things.

> It shouldn't be up to citizen watchdogs to yank computers from people because they have a terminal up appear to be hacking things.

Which is entirely reasonable, but I don't see anyone advocating this nor does the article so I'm a bit confused. Is someone advocating some kind of Chinese pogrom here?

For example, treating a coworker poorly because of what country they're from, or what religion. Or worse, especially when unstable people get riled up by right-wing outlets.

Of course being treated unfairly and as a group sucks, and is generally stupid.

However, when a society maintains such a universal "your IP is up for grabs" approach to business from the smallest fabricator to the top levels of government, and the govt is noticed to have a top level program targeting a region's business, that's not prejudice, it is established fact.

Moreover, getting the word out on such issues is exactly what you advocate; it is a part of the 'spy-vs-spy' people doing their job.

The network of suppliers is extremely extensive, and expecting the CIA to squander time individually contacting every single sub-subcontractor, or even only the set of ITAR-registered producers is silly.

I would go so far as to say that the threat against you even from overt discrimination is less than the threat from our society being undermined by an unopposed attack on its foundations.

You seem to be making a lot of baseless assumptions about this topic

For the more extreme effects, involving unstable peple, we see a lot of this in the news lately, most recently this weekend: https://www.cnn.com/2019/04/06/politics/ilhan-omar-new-york-...

For everyday workplace/community culture, we in the US have a long and ongoing history of biases and poor treatment (including in the workplace) of people belonging to identifiable groups that have been singled out as somehow threatening or lesser. Maybe the pattern repeats. Or maybe the pattern doesn't repeat this time, but many people in the group fear it will, and that's not good for workplace/community either.

> For example, treating a coworker poorly because of what country they're from, or what religion. Or worse, especially when unstable people get riled up by right-wing outlets.

Since you're the poster, where are you getting this from? I'm not reading that in either the replies nor the article... this feels like scaremongering in the opposite direction.

Completely agree but I'd bet that, if this was an article about US spies, there would be hundreds of comments deriding it by now.

If the US government engaged in industrial espionage against a foreign company, whatever US company benefitted could be sued in a US court.

What troubles me (and many others) about the PRC's behavior is the PRC's disregard for IP: US/European/other countries have no recourse.

https://law.stanford.edu/2018/04/10/intellectual-property-ch...

In theory yes in reality no. In cases of both China and the USA. Please cite any exceptions of where anything as such went to court. The reason being that it's very difficult to prove that your secrets were stolen. Sure you can sue companies for copying your products, and you can also prevent US and Europe from importing goods from China which have been copied even if you can't get a Chinese court to decide wrongdoing in your favor.