> This case should be quoted in every discussion about 5G mobile equipment here in Europe.

Especially since the 5G situation even kinda smells the same:

https://www.washingtonpost.com/graphics/2020/world/national-...:

> As Widman settled in, the secret partners adopted a set of principles for [Crypto AG's] rigged algorithms, according to the BND history. They had to be “undetectable by usual statistical tests” and, if discovered, be “easily masked as implementation or human errors.”

> In other words, when cornered, Crypto executives would blame sloppy employees or clueless users.

https://www.theregister.co.uk/2019/03/28/hcsec_huawei_oversi...:

> Huawei savaged by Brit code review board over pisspoor dev practices

> "The work of HCSEC [Huawei Cyber Security Evaluation Centre]… reveals serious and systematic defects in Huawei's software engineering and cyber security competence," said the HCSEC oversight board in its annual report, published this morning.

Towards which conclusion? Backdoors are common practice and so we have to assume their existance in foreign equipment? Or we did it first, so let's give the others a chance to deliver backdoors to us?

To maintain control over critical communication technology.

The problem is that 5g wasn't designed to be secure against malicious carriers & governments. It could have been, and modern cryptographic protocols used over it can be.

The assumption that you can trust communications infrastructure is outdated. It must not matter if an adversary has back doored a router or cell tower or similar to send copies of all traffic to them, since the data should be entirely encrypted (except for some minimal routing information). The 3GPP designed the 5G standards to allow back doors, so we get back doors.

What if the same company also provides the cellphones and computers used to do the encryption of the data being sent?

Then you're programming Satan's computer[1] and need to start doing things like using a better trusted OS & compiler. Or go to a different vendor. Since end-user devices need to swap around a lot this tends to be a lot easier than replacing the underlying infrastructure devices.

[1] https://www.cl.cam.ac.uk/~rja14/Papers/satan.pdf

[oops, misread comment.]

Making our own 5G equipment != Actually buying it.

Every country designing and making their own 5G equipment seems impractical (not to mention expensive, likely full of bugs=backdoors, etc), I think the correct conclusion to draw from that is that you need to use end-to-end (really point-you-trust-to-other-point-you-choose-to-trust) encryption.

It's like checksums, really ;) Point-to-point is helpful, but not sufficient.

I don’t think GP asked for every country manufacturing their own equipment, rather they should ask for significant insight and auditing into the design and making of critical infrastructure