More Signal. Less Noise.

V2 | Issue 101 | 5.26.20

China cracks down, US pushes back, and UK moves to exclude Huawei from 5G.

Summary

By the CyberWire staff

At a glance.

China extends national security law to Hong Kong.
The US Commerce Department sanctions Chinese firms for participation in Uyghur oppression.
Britain draws up plans to remove Huawei from its 5G infrastructure by 2023.
Tech sector lobbies the US House to prohibit warrantless collection of search histories.
States call for Federal cyber funds.

China extends national security law to Hong Kong.

China has announced its intention to impose national security laws on Hong Kong immediately, as an anti-sedition measure, the Guardian reports. This is widely regarded as marking the end of the one-country, two-systems policy under which Hong Kong's return to Chinese rule was negotiated, and it's also being regarded with alarm internationally, where, according to Kyodo News, the move is thought likely to provoke further sanctions against China. Reason calls the policy "an end to Hong Kongers' freedom," and if the increase in VPN installations in the city noticed over the past week by AtlasVPN is any indication, Hong Kongers seem inclined to agree. How well Beijing proves able to digest the relatively free population of Hong Kong remains to be seen.

The US Commerce Department sanctions Chinese firms for participation in Uyghur oppression.

On Friday the US Department of Commerce added nine Chinese organizations to the Entity List that limits their ability to trade with US organizations. They're specifically being sanctioned for their role in "human rights abuses in the Xinjiang Uighur Autonomous Region" (XUAR). Two of the organizations are cited for direct participation in human rights abuses, the People’s Republic of China’s Ministry of Public Security’s Institute of Forensic Science, and the commercial firm Aksu Huafu Textiles Company. Seven other companies are cited for "enabling China’s high-technology surveillance in the XUAR." These companies include CloudWalk Technology, FiberHome Technologies Group and its subsidiary Nanjing FiberHome Starrysky Communication Development, NetPosa and its subsidiary SenseNets, Intellifusion, and IS’Vision.

All nine entities are, the US says, "complicit in human rights violations and abuses committed in China’s campaign of repression, mass arbitrary detention, forced labor and high-technology surveillance against Uighurs, ethnic Kazakhs, and other members of Muslim minority groups in the Xinjiang Uighur Autonomous Region." Placement on the Entity List "imposes additional license requirements on, and limits the availability of most license exceptions for, exports, re-exports, and transfers (in-country) to listed entities."

Britain draws up plans to remove Huawei from its 5G infrastructure by 2023.

Under Parliamentary pressure from the ruling Tory majority and diplomatic undertakings from the US and Australia, the British Government is reconsidering its decision to allow Huawei to participate in the country's 5G build-out, TechCrunch reports. The Government is now drawing up plans that would remove Huawei from the country’s 5G infrastructure by the year 2023.

The Government had formerly planned to cap Huawei’s share of the British market at 35%, and to exclude the company from participation in “core” infrastructure. Under the new plans, at least three of the Five Eyes are now relatively closely aligned in their approach to the risk of infrastructure being compromised by Chinese intelligence services. The US had suggested that allowing Huawei and similar companies into a country’s networks would gravely limit the amount and quality of information the US would be willing to share with its allied counterparts.

The British move comes after a week in which the US announced stiffer export controls that would effectively keep US-developed semiconductors out of Huawei’s hands. Huawei acknowledges that the latest export controls would impose a hardship on the company, but also told Yahoo Finance that excluding the company from participation in 5G markets will only slow down the progress of 5G technology generally. They’re also expected to drive Chinese tech sector in the direction of greater autarky.

Tech sector lobbies the US House to prohibit warrantless collection of search histories.

A tech industry group has written the US House of Representatives urging explicit prohibition of "warrantless collection of internet search and browsing history" in the USA FREEDOM Reauthorization Act.

States call for Federal cyber funds.

US state and local governments are seeking Federal cash assistance to help them deal with rising cyber threats during the pandemic emergency, the Hill reports. Some of the needs are correlated with the increased traffic (and a larger attack surface) presented by COVID-19 emergency relief programs.

Selected Reading

Beijing to impose Hong Kong security laws 'without delay' (the Guardian) China says it will rush through anti-sedition law as police fire teargas at protesters

China's declaring security law in Hong Kong draws global concern (Kyodo News+) China's parliament says it is enacting a law banning subversion and terrorism acts in Hong Kong to protect the national interest, but the decision has ruffled feathers among foreign governments, particularly the United States that is mulling sanctions in response.

A Huge Blow to Hongkongers' Freedoms (Reason.com) New legislation proposed in Beijing signals the likely end of the "one country, two systems" policy that has allowed Hong Kong to flourish.

VPN installs in Hong Kong surged 150 times in the last 7 days (Atlas VPN) According to Atlas VPN user data, VPN (Virtual Private Network) installs in Hong Kong increased by 150 times in the last 7 days. The rise in the number of installs started on May 21, 2020. In just a single day, the number of installs surged by 520%.

UK government reverses course on Huawei’s involvement in 5G networks (TechCrunch) Conservative members of the United Kingdom’s government have pushed Prime Minister Boris Johnson to draw up plans to remove telecom equipment made by the Chinese manufacturer Huawei from the nation’s 5G networks by 2023, according to multiple reports. The decision by Johnson, who wanted…

Britain planning to reduce Huawei's involvement in 5G (Computing) Government gives in to pressure from MPs and the US

()

China BLOW: UK launches new inquiry into Huawei's risk to security (Express.co.uk) SECURITY officials have launched a review into the risks posed by Huawei to the British telecoms network.

UK looks at impact of U.S. sanctions on Huawei cooperation (Reuters) The United Kingdom is looking carefully at any impact the United States' new sanctions on Huawei might have on British networks, a government spokesman said.

Cyber security review may spell end for Huawei 5G deal (the Guardian) Government set for climbdown after US bans on Chinese telecoms group and growing resistance from backbenchers

Huawei Will Leave U.S.,'Won't Come Back' Over New Ban, Says Security Chief (Bloomberg) The U.S. has increased restrictions on the Chinese telecom giant Huawei, banning any chipmaker using American equipment from supplying gear to the company. Andy Purdy, Huawei U.S.A. chief of security, discusses the restrictions with Emily Chang on "Bloomberg Technology."

US sanctions to slow down deployment of 5G technology: Huawei exec (Yahoo) The U.S. Commerce Department’s move to expand sanctions against Chinese telecommunications giant Huawei threatens to delay the rollout of 5G technology globally, Paul Scanlan, the company’s chief technology officer said.

Trump and friends: Where European countries come down on Huawei (POLITICO) Deadline to beef up 5G security rules shows which capitals tally with US administration on Chinese gear.

A star-spangled spanner in the works: how US secrecy controls Australian weapons (The Sydney Morning Herald) This is a matter of Australia's sovereignty. The lesson of history is that the US will not necessarily leap to Australia's defence in its hour of need, yet Australia cannot even know the source codes of its own weapons systems while America keeps them secret.

()

After more Chinese tech firms are blacklisted by the US, companies speak out (Abacus) Along with various AI companies, cybersecurity company Qihoo 360 was also put on the US entity list

Selective decoupling: phasing out domestic deployment of Chinese telecoms technology (International Law Office) Through an array of legislative and administrative measures, the government has made significant strides in recent years to limit, and perhaps end altogether, the proliferation of Chinese-origin telecoms technology in US infrastructure. While some of the legislation is company agnostic, Chinese telecoms giant Huawei, which remains on the Department of Commerce, Bureau of Industry and Security's Entity List, is a primary target.

Trump Considers Forming Panel to Review Complaints of Online Bias (Wall Street Journal) The president is considering establishing a panel to review complaints of anticonservative bias on social media, a move that would likely draw pushback from tech companies.

Opinion | U.S. cybersecurity deficiencies can no longer be ignored (Washington Post) The pandemic threat obscures the vulnerable state of U.S. cyberdefenses — a vulnerability that must be addressed.

Democratic bills crack down on how political campaigns can target ads on Facebook and Google (CNBC) Sophisticated targeting tools are part of what has made digital platforms like Facebook and Google valuable tools for political advertisers.

Sens. Ask FBI, CISA How to Protect COVID-19 Medical Research Data (HealthITSecurity) Following reports that hackers from the People's Republic of China are targeting COVID-19 medical research, four Senators ask the FBI and DHS CISA how they're protecting the intellectual property.

California Activists Ramp Up Fight Against Facial-Recognition Technology (Wall Street Journal) California privacy advocates are mobilizing to thwart a bill backed by Microsoft that would regulate facial-recognition technology and that is working its way through the state legislature.

New Zealand introduces Bill to block violent extremist content (ZDNet) It would make the livestreaming of objectionable content a criminal offence, censorship calls would be made immediately, and take-down notices would be backed by law.

Turkish State Broadcaster Launches Russian Channel To Fight 'Disinformation and Manipulation' (RadioFreeEurope/RadioLiberty) Turkey’s state-run TRT broadcaster on May 24 launched a new Russian digital platform.

Iran and Israel: Already at War in Cyberspace? (The National Interest) An Iranian cyber-attack on Israeli water infrastructure provoked a response from Jerusalem in May. Is this the start of something far more troubling?

Iran struck first. 'Israel' retaliated massively. Behind the cyber war rattling the Middle East (Haaretz) The retaliation attributed to Israel by Washington Post aimed neither to cause physical damage nor casualties, but to send a warning: We can harm you tenfold

Israel response to cyber attack sends clear warning to Iran (Al-Monitor) The Israeli authorities reportedly took Iran's cyber attack on its water systems very seriously, retaliating quickly and warning Tehran of its capabilities.

'Scrutinized for years:' PPP loan investigations could last a long time (Washington Business Journal) PPP loan recipients need to keep diligent records, because you never know who will ask for what and when.

Big Brother is eyeing some PPP loans. Here's why it might be time to give the money back. (Silicon Valley Business Journal) Public blowback against some larger companies caused the SBA to issue new guidance, altering the PPP landscape, experts say.

Contact-tracing app may become a permanent fixture in major Chinese city (Register) Hangzhou wants a 'health and immunity firewall'

How did the Covidsafe app go from being vital to almost irrelevant? (the Guardian) The PM told Australians in April the contact tracing app was key to getting back to normal but just one person has been identified using its data

Survey: Nearly Half of Americans Refusing or Unlikely to Opt-In to COVID-19 Contact Tracing Apps (Security Boulevard) Increased application and software usage heighten security concerns amongst consumers The past few months have placed digital transformation into overdrive, with consumers gravitating toward distance-enabling technology and applications more than ever before. While the benefits of these tools are clear in maintaining a sense of normalcy and continuity in our personal and professional lives, maliciousRead More ›

Secret data and the future of public health: why the NHS has turned to Palantir (New Statesman) In May 2003, the venture capitalist Peter Thiel and four co-founders launched the data-mining company Palantir. Named after an all-seeing crystal ball in JRR Tolkien’s The Lord of the Rings, and initially partially funded by the CIA, the company has secured a series of contentious but lucrative public sector contracts in the US, covering predictive policing, migrant surveillance and the development of battlefield software.

Israel limits coronavirus cellphone surveillance to 'special cases' (Reuters) The Israeli cabinet limited on Sunday the involvement of the Shin Bet security service in the cellphone-tracking of people infected by the coronavirus, saying the measure would be a last resort where epidemiological investigation proves insufficient.

Singapore looking at wearable devices to support COVID-19 contact tracing (ZDNet) To address concerns about battery life and the use of Bluetooth in its contact tracing app, the Singapore government is now developing wearable devices, tied to a lanyard, to help drive the adoption rate of such technologies in the country.

Privacy advocates demand clarity over Covid-19 datastore (ComputerWeekly) Government and NHS face questions about the involvement of private technology companies with coronavirus datastore.

()

How the pandemic will change supply chain strategy (Computing) The emphasis will be more on ensuring a diversity of suppliers and less on cost-cutting say experts

More security concerns from cyberspace and foreign actors (RCI | English) Cyber threats to research, acquisition through business investment It was only a week ago that the Canadian Security Establishment (CSE) and the Canadian Security Intelligence Service (CSIS) issued an unusual joint statement, “that it is near certain that state sponsored actors have shifted their f

Coronavirus ‘Fake News’ Arrests Are Quieting Critics (Foreign Policy) In Southeast Asia, the coronavirus pandemic has provided a handy excuse for a clampdown on free speech.

Goodbye, Government. Hello, Mafia. (Foreign Policy) From insurgent groups to charities, a range of nongovernmental organizations are stepping in to respond to the coronavirus crisis.