The real problem with China

12.06.2006

Meanwhile, the U.S. government has made one high-profile (but once again, low-intelligence) effort to prove itself security-conscious where China's concerned. There has been a lot of talk about how much of Lenovo, the largest PC manufacturer in China, is actually owned by the Chinese government, and why that might pose a security risk if Lenovo-built computers (particular the popular ThinkPad line, which Lenovo acquired in 2004) are used by U.S. State Department employees.

Let's assume that China has a controlling interest in Lenovo. What does that imply, and why would the U.S. ban Lenovo computers from operating on classified Department of State networks? In the worst-case scenario, you must assume that the Chinese government, whether or not it directly controls the company, can strongly influence any Chinese firm. Theoretically, China could implant Trojan horse software into the hardware, firmware and software that would cause the systems to fail or would allow for back doors for Chinese intelligence or military agencies.

Such a sequence of events is not without antecedents, both a lot closer to home than Beijing. The NSA supposedly convinced Crypto AG, a Swiss cryptography company, to give the NSA a backdoor into its cryptographic devices. Likewise, the U.S. Department of Defense banned Checkpoint firewalls, because Checkpoint is an Israeli company and the company would not allow the U.S. government to look at the source code.

To secure U.S. Department of State computers against the worst-case scenario I've described, the department would have to reverse-engineer the Lenovo computers and all pre-installed code to see if there are any suspicious system modifications. They would actually have to reverse-engineer a lot of individual systems, since it would be possible for China to modify only a subset of the systems sold to the U.S. government. Testing a number of individual systems in this fashion would be very expensive in both time and money.

But why should the U.S. government confine its worries to Lenovo? Just as the NSA was able to influence a Swiss company, China might be able to influence companies in other countries. Moreover, computers from most manufacturers are constructed in or composed of parts that are manufactured in China and other Asian countries. While a Chinese-controlled company might well be susceptible to Chinese government influence in putting in back doors, it is just as likely that computers or components from any other company or country are equally compromised.