Updated An almighty row broke out on Tuesday over the cops-only backdoor Huawei builds into its cellular network products and who exactly can access it.
The US government, via an anonymously sourced story in the Wall Street Journal, said this so-called "lawful interception interface" is baked into Huawei's cellular network gear, and that it can be secretly accessed remotely by Huawei staff, and that this capability has existed for more than a decade.
This would be bad because, according to the government, Huawei staff can be ordered by Beijing to exploit this remote access to covertly monitor people's communications and internet traffic without carriers' permission or knowledge. In effect, it is claimed, the backdoor can be used by the Chinese government to spy on any network in the world that uses Huawei's gear.
The newspaper noted that US intelligence officials conveniently declined to say whether or not they had seen Huawei inappropriately breaking into networks to snoop on folks.
Huawei has denied the accusation. Well... it denied it has or will silently access the lawful interception interface behind carriers' backs. The interface is an industry standard and definitely present – so that network operators can provide communications to criminal and government investigators – Huawei's just pinky-swearing it would never abuse this feature nor access it without permission. Its staff can drill into a network, presumably to do some remote management or assistance, but only with carriers' approval.
The Chinese mega-maker said in a statement:
Huawei has never and will never do anything that would compromise or endanger the security of networks and data of its clients. We emphatically reject these latest allegations. Again, groundless accusations are being repeated without providing any kind of concrete evidence.
The use of the lawful interception interface is strictly regulated and can only be accessed by certified personnel of the network operators. No Huawei employee is allowed to access the network without an explicit approval from the network operator.
These claims of covert surveillance are made time and time again by US government officials, that Huawei bugs its gear to allow Beijing officials to break in at will and spy on any mobile carrier – and their subscribers – that uses Huawei hardware. With that argument, America has pressed its allies, particularly Germany and the UK, to stop deploying Huawei equipment. We note that, funnily enough, the WSJ article was penned by its Germany bureau staff.
Low Barr: Don't give me that crap about security, just put the backdoors in the encryption, roars US Attorney GeneralREAD MORE
At the heart of this latest report, which is light on technical detail, is the claim that the remote access would be carried out by Huawei, under orders from China, without any notification to the mobile carrier – which Huawei denies.
This therefore puts Uncle Sam in an amusing spot. It can't be against the concept of lawful interception interfaces in Huawei's gear because it, too, wants the ability to snoop on people on demand. Don't forget, as well as wanting to cripple strong encryption with Feds-only backdoors, the US government maintains laws that require networks and equipment makers grant agents access to certain information on demand – though those laws require cooperation from the carriers and manufacturers, and not unilateral, silent access.
Thus, the US government is left railing against Huawei for, allegedly, maintaining the ability to silently and secretly snoop on networks.
Because God forbid anyone secretly spies on people without warning, such as by intercepting data-center links, or bugging routers in transit, or championing flawed cryptographic algorithms, or straight-up breaking into foreign telcos... and, yeah, you get the picture.
If anyone's going to silently snoop on anyone, it's Uncle Sam – not China, thank you very much. ®
Updated to add
Huawei has sent us a few more details about its lawful interception interfaces, while still denying Uncle Sam's claims:
US allegations of Huawei using lawful interception are nothing but a smokescreen – they don't adhere to any form of accepted logic in the cyber security domain. Huawei has never and will never covertly access telecom networks, nor do we have the capability to do so.
Huawei's role as a telecoms vendor is to provide equipment that follows 3GPP/ETSI standards, just like every other vendor. We are obligated to follow industry-wide lawful interception standards like 3GPP's TS 33.107 standard for 3G networks, and TS 33.128 for 5G. This is where Huawei's obligations with regards to lawful interception end.
The actual administration and use of lawful interception interfaces is conducted solely by carriers and regulators. Interception interfaces are always located in protected premises on the operator's side, and they are operated by employees who are vetted by the government in the countries where they operate. Operators have very strict rules to operate and maintain these interfaces. Huawei doesn't develop or produce any interception equipment beyond this.
Huawei is only an equipment supplier. In this role, accessing customer networks without their authorization and visibility would be impossible. We do not have the ability to bypass carriers, access control, and take data from their networks without being detected by all normal firewalls or security systems.