This has nothing to do with convincing the general public. The US is struggling to convince their own allies that the threat is real, and definitely haven't convinced the technical community they need to stop buying e.g. Huawei hardware.

> The existence of the threat is already well publicized.

Parroting the same vague "there's a threat, but the threat is secret so we cannot tell you about it" isn't well publishing anything. It is bordering on fear mongering. A well publicized threat would be a series of white papers describing in technical terms the weaknesses/backdoors/etc in Chinese manufactured hardware.

You don't need a whitepaper to say "Any device with over-the-air updates (or server-side processing) controlled by a Chinese company can receive anytime new software (thus a payload) controlled by the Chinese intelligence services".

This is what's implied.

It feels more likely to imply that "we have no hard evidence". So the argument still boils down to "because China", not "because spying". Which isn't a strong argument if you like to (at least try to) draw your own conclusion and not be fed one.

Are you worried that your iPhone or Tesla will be hijacked the same way? You already know this happened before with the knowledge of the companies involved (secret subpoenas or national security letters) or without it (beacon implants).

> It feels more likely to imply that "we have no hard evidence".

There is hard evidence of the vulnerability, which logically follows from any OTA update capability, but there may be no hard evidence of exploitation yet.

Think of it this way: if your software has a RCE, you fix or mitigate it regardless if it's actively being exploited or not.

> Are you worried that your iPhone or Tesla will be hijacked the same way?

That's a very valid concern for some people.

Ultimately, software security boils down to "who do you trust?". Say what you will about the US, but your goals and values are very likely less incompatible with those of the US than with those of authoritarian China [1] [2].

[1] https://www.nytimes.com/2013/08/20/world/asia/chinas-new-lea...

[2] https://en.wikipedia.org/wiki/Document_Number_Nine

The lesser evil. The enemy of my enemy is my friend. History is full of examples where people followed short term aligned interests straight into long term suffering.

Do you think it's more about your values or somebody's ego and interests?

Lets be real here "because China" is a decent enough argument in the US at the moment. Just swallow the propaganda.

This is a great argument against all OTA devices.

But if the US actually took that threat seriously, half of the Valley would be out of a job tomorrow.

> This is a great argument against all OTA devices

Indeed. And for life safety uses it's appropriate. In safety-conscious settings such as those involving line voltages requiring NRTL (UL for ex) listing OTA updates are forbidden: One must have physical access to the device to perform a permitted [0] code update.

[0] And the code updates themselves are subject to IEC 60730/UL 1998 or it's back to the NRTL for more testing

It's a great argument for devices made in the US. We can't trust Chinese tech yet we don't make our own.

> The US is struggling to convince their own allies that the threat is real

The US has to convince their allies that buying from China is more dangerous than buying from the US. I don't think anybody doubts there isn't a threat.

> I think that U.S. intelligence does not talk about specific threats because the attack vectors would probably misunderstood and underestimated by the general public.

I doubt intelligence agencies care about convincing public one way or another. I suspect they are worried about revealing details of their methods and thus have a blanket "say nothing" default mindset.

> "I doubt intelligence agencies care about convincing public one way or another"

Why say anything at all then? Saying nothing is one thing, but they are saying something. Why the half-hearted messaging? I honestly don't get it.

> I doubt that it would damage China. The existence of the threat is already well publicized.

It'd certainly damage Chinese companies and curtail those companies' utility as sources of intelligence. How many drones do you think DJI would sell if it became known that flight logs and aerial photos were being uploaded to the Chinese government? (This is all purely hypothetical but the DJI app is very aggressive about permissions and updates, so they absolutely could if they wanted to. I have a dedicated phone for mine which never gets to connect to the internet, for this very reason.)

> How many drones do you think DJI would sell if it became known that flight logs and aerial photos were being uploaded to the Chinese government

Roughly about as many as today. A recreational or content production drone is sitting dead without a battery >>95% of the time. This is a much weaker threat model (both objectively and in the perception of consumers) than all those connected, always-on microphones and cameras installed in homes, offices and pockets.

I mention this as a precedent: to many people out there, "the Chinese government" isn't a lot more foreign than "some American tech empire" and data-derived unpleasantries are far more likely to have practical implications for them with US immigration than with the Chinese communist party (because the US is still more open). And yet those people still buy westcoast-designed (and connected) devices like hotcakes.

Nobody wants to give up cheap Chinese goods and buy expensive American goods (which are all made in China just the same hilariously) simply because America asks so nicely. Yeah I just ordered a Xiaomi mi9 and I feel fine.

If there was indeed a threat to national security I trust my own government to make decisions not the US.