Investigating Cisco: the front page story in China Economy and Informatization
With the US Congress taking swings at Huawei and ZTE it was only a matter of time before China took some swings of its own. Now, the magazine China Economy and Informatization has run a front-page story about the security threat posted to China by Cisco and other US companies, based primarily on data from China’s National Computer Network Emergency Response Team (CNCERT).
According to the article, more than eight of Chinese servers are being controlled by American sources via trojan horses and botnets. It also says that 3 out of 4 IPs found to be imitating Chinese banking sites originated in the US. The article jumps straight from there into a condemnation of Cisco and the “eight American King Kongs” that have made an “empty shell” out of Chinese information security. It quotes an anonymous information security expert as saying, “China is basically standing naked in front of the armed-to-the-teeth eight American King Kongs.”
But it turns out that’s pretty misleading. The article cites data from 2011, but CNCERT’s most recent information security report rates the threat to China as “moderate,” makes zero mention of Cisco, and does not suggest that the US or US companies pose any particularly grave threat as compared to other nations. CNCERT’s 2011 report — which, presumably, is the data set China Economy and Informatization was drawing from — is roughly the same. The United States is mentioned only twice as the source of attacks mentioned in the report, and is not listed as a significant threat. Cisco isn’t mentioned at all, and CNCERT’s summary of 2011 states that “China’s internet and network security situation continues to be stable, without any major internet safety incidents” and that things are generally improving. That is certainly a far cry from the China-is-naked picture painted by China Economy and Informatization and its anonymous expert.
It’s worth mentioning that China Economy and Informatization magazine is administrated by China’s Ministry of Industry and Information Technology. As a part of the state-run media and a representative of government interests, the magazine’s objectivity is certainly questionable, but for the same reason, it’s possible that the magazine is offering a glimpse into the future, and some idea of what the justification for a Chinese government investigation of Cisco could look like.
Of course, it is certainly true that a lot of the software and hardware used to access the web comes from the United States, though that’s probably not a sinister imperialist plot as much as it is a reflection of the fact that the United States has been a center of innovation and development in computing and internet technology for decades. Still, it’s understandable that this would make other nations, including China, nervous. But why the specific focus on Cisco as a threat in the China Economy and Informatization article? It’s not entirely clear.
CNCERT’s reports don’t cite the company as a specific threat, and the magazine’s evidence against Cisco is sketchy at best. Cited reports of Cisco interference are limited to a 2005 internet outage for some Beijingers that was traced to a piece of Cisco equipment, and IPTV drops for Xiamen Telecom users in early 2011 that were also blamed on Cisco technology. These temporary outages must have been annoying for the minority of users they affected, but it’s unclear how they represent a threat to China’s national security. Later, the article alleges that Cisco has “an extremely close relationship with the NSA,” but the only evidence cited for this is that 71 US congressmen (or about 13 percent of Congress) own shares of Cisco stock.
The article also states that reporters “learned” Cisco’s operating system is full of security flaws, although it does not say how reporters acquired this information or what its source is.
All of this is not to say that Cisco equipment doesn’t pose a threat to Chinese information security. Although the article does a poor job of supporting its case and it seems probable there are political reasons behind its publication, Cisco probably does have a close relationship with the US government, and as the article rightly points out, the Patriot Act can compel American tech companies to turn information about overseas users over to American intelligence organizations, which could indeed pose a threat to other nations’ national security.
As you might expect, the comments piling up on this article are quite divisive, with some net users agreeing that Cisco and other American companies should be investigated, and others accusing the author of being a party stooge and suggesting that replacing American technology with Chinese tech might only make things worse.
Regardless of whether Cisco or other American companies actually pose a security threat to China’s IT security, Chinese companies like China Unicom are already moving away from Cisco equipment and replacing it with domestic brands. This may in part be because of security issues, but it’s also because the domestic technology industry has been developing by leaps and bounds, and domestic companies that weren’t real players five or ten years ago are now capable of competing with Cisco and other international brands, at least when it comes to domestic contracts.
Will the Chinese government investigate Cisco and other American tech companies? It is not yet clear, but such an investigation is not unlikely. China’s government does have a history of pointing out what it sees as American hypocrisy; for example, each year it issues its own human rights report on the US timed to correspond with the US’s yearly human rights report on China. Moreover, the use of a state-run publication to promulgate these allegations against Cisco certainly implies that the government is watching this issue carefully.
[via Sina Tech]
The post Report Says Cisco, Other US Companies Pose Threat to Chinese Information Security appeared first on Tech in Asia.