China crisis is a TikToking time bomb
(2023/03/27)
- Reference: 1679909410
- News link: https://www.theregister.co.uk/2023/03/27/china_crisis_is_a_tiktoking/
- Source link:
Opinion As country after country bans TikTok from official systems, it’s fair to ask what’s so dodgy about a social network filled with dance crazes, makeup advice and cats.
You can understand why selling the Middle Kingdom state-of-the-art EUV lithography gear might be a bad idea, but this? Is it the xenophobia China often blames for Western reticence? Plain old trade barriers? Cold war cultural imperialism? No, it really is a security matter, and one that’s far more serious than it looks.
State security and national intelligence can look like, and often is, a proxy for political machinations. This is not that. It’s not a matter of morality or the ethical superiority of democracy. The West can bug, spy, infiltrate and deceive with the best of them. The [1]CIA secretly owned Crypto AG , a Swiss cryptography company, and most certainly snaffled a ton of data from unsuspecting organisations as a result.
[2]
There’s no equivalence here between the East and West, no two sides of the same coin. The difference is the extensive legal framework protecting Western citizens and companies from state security overreach. Imperfect and constantly stretched as it is, the law is on our side. The NSA or GCHQ cannot compel cooperation - they can ask, but even so within limits. Apple and Google can and do tell the FBI to get a warrant or go swivel. Xiaomi and Vivo don't have that option.
[3]
[4]
Chinese law, specifically [5]Article 7 of the National Intelligence Law compels all citizens and organisations to act as covert arms of state security on demand, even if overseas. There is no saying no. There is no even admitting it’s happened. Chinese owned technology companies can deny this as much as they like, in fact they have to, but the law is clear. The [6]TikTok CEO can offer all the safeguards, promises and firewalls he likes; he is required by law to secretly bypass all those on command.
This is before the obscure and impenetrable intermingling of state, military and private funding and governance for Chinese companies. The People’s Liberation Army is a major source of funding for enterprise: if you think private equity funding comes with strings in the West, wait until it comes with nuclear missiles and aircraft carriers. Then there’s the disconcerting disappearances of top executives who displease Beijing. All Chinese technology is under the direct control of Chinese state security, and all Chinese technology companies are kept in line by whatever means necessary.
[7]
TikTok isn’t anything special beyond being a lightning rod because it is so popular. By the inescapable logic of China’s own laws, no Chinese technology can be trusted not to spy on you. Be it smartphone, tablet, laptop, car, IOT or connected toy, you can’t use it if you don’t like it being a potential hotline back to the world’s most efficient and ruthless authoritarian state apparatus.
There are two possible exemptions. One is if you trust the Chinese state’s bona fides as a respecter of international law and the right of privacy. That is quite a leap of faith versus experience - just ask the [8]Qantas airline pilots who find their communication, navigation and safety systems interfered with by Chinese warships. By all means pop over and ask all the questions you like about how things work in that department. Let us know how it goes.
[9]You can't spell 'electronics' without 'elect': The time for online democracy has come
[10]The Wristwatch of the Long Now: When your MTBF is two centuries
[11]TSMC and China: Mutually assured destruction now measured in nanometers, not megatons
[12]Any fool can write a language: It takes compilers to save the world
The other possible way to defang the dragon is to demand complete oversight of technology, effectively opening the systems up to Western inspection. The UK’s been trying that appraoch with Huawei through the Huawei Cyber Security Evaluation Centre (HCSEC). For the past ten years it's been trying to get the source code from Huawei so that it can build binary equivalent images for firmware in devices used in the UK's national comms infrastructure. The last annual report, [13]published in 2021 , admitted some challenges.
There’s been no sign of a report in 2022 but that may be because UK government ruled that all Huawei kit must be ripped from UK networks by 2027... the [14]game is over . Huawei has always denied any links with the Chinese government.
If you want a taste of what they’re up against, if you own a Chinese-brand smartphone and you’re Linux-savvy, go and look at what’s in the firmware and process list. You will be entertained.
[15]
Until Chinese law is changed to respect basic principles of safeguarding rights of citizens, companies and international law, any connected device running Chinese software can be seen as an agent of the state. That state is betting the rest of the world is hungry enough for cheap tech to accept universal covert surveillance with no protection. It may even be right.
Choose how happy that makes you, but it’s just the way it is. ®
Get our [16]Tech Resources
[1] https://www.theregister.com/2020/02/11/crypto_ag_backdoored_german_swiss_news_allegs/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZCFpRXQhz3fSvJ1JkTHJ8QAAAJY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZCFpRXQhz3fSvJ1JkTHJ8QAAAJY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZCFpRXQhz3fSvJ1JkTHJ8QAAAJY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://en.wikipedia.org/wiki/National_Intelligence_Law_of_the_People%27s_Republic_of_China
[6] https://www.cnbc.com/2023/03/23/tiktok-ceo-china-based-bytedance-employees-can-still-access-some-us-data.html
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZCFpRXQhz3fSvJ1JkTHJ8QAAAJY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2023/03/20/vessels_claiming_to_be_chinese/
[9] https://www.theregister.com/2020/11/02/electronic_voting/
[10] https://www.theregister.com/2020/02/24/the_wristwatch_of_the_long_now/
[11] https://www.theregister.com/2022/06/13/column/
[12] https://www.theregister.com/2022/04/04/compiling_the_future/
[13] https://www.theregister.com/2021/07/20/huawei_hcsec_oversight_report_muted_criticism/
[14] https://www.theregister.com/2022/10/13/uk_telcos_huawei_ban/
[15] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZCFpRXQhz3fSvJ1JkTHJ8QAAAJY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[16] https://whitepapers.theregister.com/
You can understand why selling the Middle Kingdom state-of-the-art EUV lithography gear might be a bad idea, but this? Is it the xenophobia China often blames for Western reticence? Plain old trade barriers? Cold war cultural imperialism? No, it really is a security matter, and one that’s far more serious than it looks.
State security and national intelligence can look like, and often is, a proxy for political machinations. This is not that. It’s not a matter of morality or the ethical superiority of democracy. The West can bug, spy, infiltrate and deceive with the best of them. The [1]CIA secretly owned Crypto AG , a Swiss cryptography company, and most certainly snaffled a ton of data from unsuspecting organisations as a result.
[2]
There’s no equivalence here between the East and West, no two sides of the same coin. The difference is the extensive legal framework protecting Western citizens and companies from state security overreach. Imperfect and constantly stretched as it is, the law is on our side. The NSA or GCHQ cannot compel cooperation - they can ask, but even so within limits. Apple and Google can and do tell the FBI to get a warrant or go swivel. Xiaomi and Vivo don't have that option.
[3]
[4]
Chinese law, specifically [5]Article 7 of the National Intelligence Law compels all citizens and organisations to act as covert arms of state security on demand, even if overseas. There is no saying no. There is no even admitting it’s happened. Chinese owned technology companies can deny this as much as they like, in fact they have to, but the law is clear. The [6]TikTok CEO can offer all the safeguards, promises and firewalls he likes; he is required by law to secretly bypass all those on command.
This is before the obscure and impenetrable intermingling of state, military and private funding and governance for Chinese companies. The People’s Liberation Army is a major source of funding for enterprise: if you think private equity funding comes with strings in the West, wait until it comes with nuclear missiles and aircraft carriers. Then there’s the disconcerting disappearances of top executives who displease Beijing. All Chinese technology is under the direct control of Chinese state security, and all Chinese technology companies are kept in line by whatever means necessary.
[7]
TikTok isn’t anything special beyond being a lightning rod because it is so popular. By the inescapable logic of China’s own laws, no Chinese technology can be trusted not to spy on you. Be it smartphone, tablet, laptop, car, IOT or connected toy, you can’t use it if you don’t like it being a potential hotline back to the world’s most efficient and ruthless authoritarian state apparatus.
There are two possible exemptions. One is if you trust the Chinese state’s bona fides as a respecter of international law and the right of privacy. That is quite a leap of faith versus experience - just ask the [8]Qantas airline pilots who find their communication, navigation and safety systems interfered with by Chinese warships. By all means pop over and ask all the questions you like about how things work in that department. Let us know how it goes.
[9]You can't spell 'electronics' without 'elect': The time for online democracy has come
[10]The Wristwatch of the Long Now: When your MTBF is two centuries
[11]TSMC and China: Mutually assured destruction now measured in nanometers, not megatons
[12]Any fool can write a language: It takes compilers to save the world
The other possible way to defang the dragon is to demand complete oversight of technology, effectively opening the systems up to Western inspection. The UK’s been trying that appraoch with Huawei through the Huawei Cyber Security Evaluation Centre (HCSEC). For the past ten years it's been trying to get the source code from Huawei so that it can build binary equivalent images for firmware in devices used in the UK's national comms infrastructure. The last annual report, [13]published in 2021 , admitted some challenges.
There’s been no sign of a report in 2022 but that may be because UK government ruled that all Huawei kit must be ripped from UK networks by 2027... the [14]game is over . Huawei has always denied any links with the Chinese government.
If you want a taste of what they’re up against, if you own a Chinese-brand smartphone and you’re Linux-savvy, go and look at what’s in the firmware and process list. You will be entertained.
[15]
Until Chinese law is changed to respect basic principles of safeguarding rights of citizens, companies and international law, any connected device running Chinese software can be seen as an agent of the state. That state is betting the rest of the world is hungry enough for cheap tech to accept universal covert surveillance with no protection. It may even be right.
Choose how happy that makes you, but it’s just the way it is. ®
Get our [16]Tech Resources
[1] https://www.theregister.com/2020/02/11/crypto_ag_backdoored_german_swiss_news_allegs/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZCFpRXQhz3fSvJ1JkTHJ8QAAAJY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZCFpRXQhz3fSvJ1JkTHJ8QAAAJY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZCFpRXQhz3fSvJ1JkTHJ8QAAAJY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://en.wikipedia.org/wiki/National_Intelligence_Law_of_the_People%27s_Republic_of_China
[6] https://www.cnbc.com/2023/03/23/tiktok-ceo-china-based-bytedance-employees-can-still-access-some-us-data.html
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZCFpRXQhz3fSvJ1JkTHJ8QAAAJY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2023/03/20/vessels_claiming_to_be_chinese/
[9] https://www.theregister.com/2020/11/02/electronic_voting/
[10] https://www.theregister.com/2020/02/24/the_wristwatch_of_the_long_now/
[11] https://www.theregister.com/2022/06/13/column/
[12] https://www.theregister.com/2022/04/04/compiling_the_future/
[13] https://www.theregister.com/2021/07/20/huawei_hcsec_oversight_report_muted_criticism/
[14] https://www.theregister.com/2022/10/13/uk_telcos_huawei_ban/
[15] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZCFpRXQhz3fSvJ1JkTHJ8QAAAJY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[16] https://whitepapers.theregister.com/
b0llchit
The NSA or GCHQ cannot compel cooperation - they can ask, but even so within limits.
Ah, you mean besides of doing illegal things, like f.ex. using NSO/pegasus on dissidents?
You are right that the Chinese have spying made legally non-optional. But telling us that the "west" is working under the rule of law is like burying you head in the sand. I don't trust east nor west with my data. Neither have proven trustworthy when push comes to shove.
The real difference is that telling this story in the west is less likely causing you to be thrown into jail or simply vanish mysteriously. However, there are very notable exceptions, effectively causing you to lose your freedom, when you publish illegal actions committed by the USA/NSA/CIA/etc.. As long as you only talk about illegal actions and don't actually document and prove them with real damning documentation, you are most probably safe in the west. Otherwise you will simply be jailed as a spy, regardless the illegality of the actions you exposed. In the Chinese rule you will simply cease to be and never to be talked about again.
Dance with the Devil
I think that article encapsulated the issues well. I suspect that for most people it will be a case of "I have nothing to hide and there products are very good value..."