China is spying on US firms using power cords

Taiwan server suppliers move off mainland at US customers' request
By LAULY LI and CHENG TING-FANG

TAIPEI -- U.S. technology companies, concerned that server power cords and plugs could be used by China to access sensitive data, have asked Taiwanese suppliers to shift production of these components out of the mainland.
Lite-On Technology, whose customers include Dell EMC, HP and IBM, is building a new factory in Taiwan to manufacture power components for servers at the request of American clients that cited cyberespionage risks from Beijing, according to one executive.
Quanta Computer, which supplies servers and data centers to U.S. tech companies including Google and Facebook, has shifted production to Taiwan and elsewhere, citing security as one of the reasons, an executive told the Nikkei Asian Review.
"Cybersecurity, tariffs and geopolitical risks are the three main factors" propelling the decision by Quanta and its clients to move production, the executive said.
The drive by U.S. information technology companies to eradicate security threats is reaching even the most mundane of components. 

Some face pressure to source these components outside of China, despite the higher production cost.
"Unlike many other Taiwanese tech manufacturers diversifying their production away from China to avoid Washington's tariffs on Chinese goods, the top priority [for Lite-On's new plant] is addressing U.S. clients' security concerns," said the Lite-On executive who has direct knowledge of the company's plan. 

The executive declined to name these clients.
Cybersecurity experts confirmed that such a risk is legitimate.
"It is totally reasonable for U.S. companies to have such concerns because, technically, it is doable and not difficult for hackers to use the power supply system or power cords to retrieve data stored in servers," Tien Chin-wei, deputy director at the Taipei-based Cybersecurity Technology Institute, told the Nikkei Asian Review.
In servers, the data warehouses of the digital economy, the structure of the power supply system is more complicated than in ordinary consumer electronic devices like smartphones or notebooks. 

This makes it difficult to detect whether unwanted chips have been implanted in the power supply during production, cybersecurity experts said.
"If the server is compromised and the chip implanted in the power supply system is activated, the power lines could serve as a covert channel to transmit data," Philippe Lin, senior threat researcher at cybersecurity company Trend Micro, told Nikkei.
Besides common targets such as servers, data centers or large telecommunications infrastructure, these attacks also could occur against personal electronic devices, the experts said. 

Free charging cable provided by public spaces in China accessed smartphone data if individuals plugged in the fast-charging cable.
Lite-On supplies power components and power supply systems used in various electronics from smartphones and notebooks to servers and data centers. 

The company's power supply systems and parts often are shipped to manufacturers like Quanta, Wistron, or Inventec for final assembly into servers.
Lite-On's American customers had been alarmed by reports from Bloomberg Businessweek last year revealing that Beijing implanted tiny chips into the data center supply chains of U.S. tech companies, the executive with the Taiwanese manufacturer said.
"The American clients want to elevate their security measures, and they also do not want to upset the Trump administration," the Lite-On executive said.
The company is investing about 10 billion New Taiwan dollars ($324 million) to construct the new facility and research center in the southern Taiwanese city of Kaohsiung, which was previously planned to make electronic components for automobiles. 

Lite-On confirmed that the focus of the facility now is to produce server power parts to address American clients' need for higher security standards. 

The facility is scheduled to begin pilot operations in June.
Major server and data center manufacturers such as Quanta, Inventec and Wistron began shifting production to Taiwan and overseas sites last year, mainly to cope with Washington's additional tariff on networking-related components and devices. 

But now some are moving off the mainland as a result of these security concerns.
However, cybersecurity experts said that simply moving production out of China will not remove all risks, as there always will be ways to manipulate the production process regardless of the location.
"Every interface between components, or between motherboards and power supply systems could be a loophole for malicious implants," the Cybersecurity Technology Institute's Tien said. 

"You can only reduce or manage the risks, but it is not possible to entirely eliminate the threats."

Rogue Nation

China is secretly hacking computer motherboards. The economic fallout is huge.
By Henry Farrell and Abraham Newman

An electronic data display showing a map of China at the Global Mobile Internet conference in Beijing. 

Bloomberg has just published an explosive article claiming that a secret unit in the Chinese military has compromised the motherboards (the systems of chips and electronics that allow computers to work) of servers used by Apple, a bank and various government contractors.
China’s exploit was discovered when Amazon did due diligence on a company that it was acquiring, which used servers with the compromised motherboards. 

Like China, both Apple and Amazon have issued statements denying the Bloomberg claims, but Bloomberg is confident that it’s correct, saying it has multiple sources inside Amazon and the intelligence community. (Amazon chief executive Jeffrey P. Bezos owns The Washington Post.)
The exploit involved tiny components — some the size of a sharpened pencil tip — that were very difficult to spot but that provided a backdoor to the servers into which they were built. 

The components could communicate with external computers and download instructions from them, which allow Chinese military hackers to compromise passwords and gain control over what the servers did. 

If the servers were used for sensitive tasks, this kind of access could have massive security repercussions.
What is economically important, however, is how the Chinese military did this. 

They weaponized the complex supply chain through which most sophisticated electronics are built. That has huge implications for the world economy.

We live in a world of complex global supply chains
People usually think of economic globalization as involving trade in final products — cars being shipped across the U.S. border from Canada or Mexico. 

That only scratches the surface of the globalized economy, which involves not only trade in completed products but also in components and finishing. 

A complex product such as a computer may be built from components made by hundreds — or even thousands — of specialized manufacturers, located across multiple countries. 

This creates vast economic efficiencies and provides enormous economic savings, allowing companies — and even entire regional or national economies — to reap the benefits of specialization and consumers to get cheaper and better made products.
Over the last couple of decades, China has become an increasingly important supplier of technological goods. 

Chinese companies such as Foxconn specialize in manufacturing and integrating common consumer products such as iPhones. 

However, China lacks capacity in some important areas, such as the design and manufacture of high-end chips.
All this means that the world manufacturing economy relies on globalized supply chains, with myriad specialized subcontractors. 

Until recently, public debate has mostly focused on the trade-offs between the economic advantages and the human costs of these supply chains. 

For example, supply chains in the garment industry often involve the exploitation of poor workers in sweatshops for brand name goods sold in American stores, leading to increasing pressure on the brand-name manufacturers to ensure humane working conditions in their suppliers and sub-suppliers. Now, however, a new set of security problems is emerging.

Globalized supply chains increase interdependence
Global supply chains were what allowed the Chinese to hack the motherboards of servers used by U.S. companies. 

These servers were assembled by Supermicro, a U.S.-based supplier of specialized high-end servers. 

Supermicro relied on Chinese factories to provide them with motherboards and other components. 

These motherboards were then compromised by the Chinese military, which bribed or threatened four key subcontractors to get them to install the hardware-based backdoor systems.
A world of global supply chains is a world where countries’ economies and manufacturing systems are increasingly interdependent, so that if something goes wrong, everyone suffers. 

When a single factory caught fire in 2013, the price of commonly used memory chips shot up — because every computer manufacturer relied on a very small number of manufacturers.
Our academic research explores how countries are increasingly starting to weaponize interdependence— using these vulnerabilities and choke points for strategic advantage. 

China’s hacking of motherboards is a perfect example of this. 

As the Bloomberg article recounts, Chinese manufacturers dominate key aspects of computer hardware manufacturing. 

While some naive people had been confident that China would never hack exported components en masse — for fear of the damage that it would do to the Chinese economy — the Bloomberg article suggests that they have succumbed to temptation. 

The economic consequences are enormous
If the Bloomberg report is confirmed — and especially if it is one particular example of a broader problem — there will be very big economic repercussions. 

The U.S. economy and China’s economy are deeply interdependent. 

If the U.S. believes that Chinese firms are using this interdependence strategically to compromise U.S. technology systems with hardware components that undermine security, there will be pressure on the United States to systematically disengage from China and, perhaps, from global supply chains more generally.
This could have substantial knock-on repercussions for international trade, leading eventually to a world in which countries are much less willing to outsource components of sensitive systems to foreign manufacturers. 

Because we live in a world where technology is becoming ever more connected and ever more exploitable, this might mean that large swaths of the global economy are pulled back again behind national borders. 

The United States is already highly suspicious of Chinese telecommunications manufacturers, while organizations closely linked to U.S. intelligence are calling for a far more systematic reappraisal of the security implications of supply chains. 

It may be that the globalized economy of the 1990s and 2000s was a brief aberration, which will be replaced by more constrained and limited international exchange between economies that keep the important parts of their manufacturing economy at home.

Facebook Must Stay Out of China

A Faustian pact with Beijing would almost certainly make user behavior around the world visible to Chinese state security.
BY CLAY SHIRKY, ANDREW MCLAUGHLIN, KAISER KUO

Facebook has reportedly developed software to suppress posts from users’ feeds in targeted geographic areas, a feature created to help the giant social media network gain access to China, where it is blocked. 

Facebook CEO Mark Zuckerberg has long been courting China’s leaders, studying Mandarin, and talking with Chinese internet executives. 

How far should he and his company go in order to grow? 

And at what expense? 

—The ChinaFile Editors

Clay Shirky, global network professor, New York University’s Shanghai campus:
Facebook shouldn’t do this. 

Although the tool, as described, copies some industry norms — Facebook would suppress messages inside China but show them outside — it comes nowhere near what Beijing would demand for re-entry. 

At the same time, those additional conditions would make any deal not worth the cost, either ethical or financial.
Though the U.S. press often writes as if the principal goal of Chinese censorship is blocking information from the United States, the Chinese Communist Party is far more worried about its own citizens. 

This is why seemingly innocuous platforms such as Instagram and Tumblr are blocked; it isn’t what U.S. teenagers would post that worries the Chinese Cyberspace Administration, and those concerns would shape any Facebook deal as well.
Hiding selected posts from outside China would not meet the bare minimum of Beijing’s requirements for citizen surveillance. 

Facebook would have to keep data on those users on servers in Beijing and grant the government direct access. 

Offending posts by Chinese users would have to be suppressed worldwide, not just in China. (Users in Anqing would not be allowed to share posts about corruption with students in Ann Arbor.)
That’s just the geographic controls.
Beijing would demand that censorship follow Chinese citizens internationally.

They do something like this today with SIM cards, which include data headers that identify country of origin. 

Chinese SIMs are subjected to Chinese censorship, whether the user is in Dalian or Dusseldorf. (This is why Chinese mobile plans have such advantageous international rates; cheap roaming means users often don’t bother to get local SIM cards, allowing censorship to follow them worldwide.)
And the situation is not static. 

Under the bland banner of “stability maintenance,” social media regulations have been coordinated, onerous, and monotonically restrictive. 

The chop would not be dry on any contract with Facebook before it had to be renegotiated.
Against these costs, the chance that Facebook would be allowed to succeed in China is zero. 

As tech blogger Ben Thompson wrote about the ride-hailing service Uber’s failure in the country, “I’ve simply seen no way that the government tolerates foreign ownership of something as foundational as transportation infrastructure.” 

That is true of media as well, especially media Chinese citizens use to communicate and coordinate with one another.
Two decades after the ICQ messaging service launched, there is not one example of foreign social media succeeding there — not Google, not Instagram, not WhatsApp, not Twitter. 

The closest example, LinkedIn, is a business service with no threat of wide adoption and has roughly the same number of users in China and the U.K., a market 5 percent its size. 

Even Apple, selling a luxury product whose software cannot be separated from its hardware, has not been able to maintain its online services — China blocks iTunes, iBooks, and News.
The ruling Communist Party appears convinced — correctly, in my view — that freedom of speech and assembly threaten single-party rule. 

In addition, censorship is a good source of mercantile protection. 

The idea that politics differs from economics does not resonate strongly in Beijing; the ability to provide a competitive advantage to local firms is a political tool, offering the very entrepreneurs who might push for global connectivity the consolation prize of the largest market in the world.
I understand why Facebook wants this. 

It has traded as a growth stock since 2012, but user acquisition is slowing. 

Access to China would allow it to postpone that reckoning by a few years. 

But any Chinese presence would be token, negotiated more to reduce an irritant than to allow real access. 

The “some conversation is better than no conversation” argument Facebook has been making for years now simply wouldn’t hold up under the terms demanded by the party.

Andrew McLaughlin, technology executive:
Though it has been evident for years that Mark Zuckerberg really, really wants Facebook to operate in China, I’m genuinely surprised that the company appears, finally, to have made the decision to do it.
I’m surprised for two big reasons:
First, Facebook will have to facilitate Chinese spying on non-Chinese users. 

To operate in China, Facebook will have to comply not only with the party’s onerous censorship demands but also with its user surveillance requirements. 

Through a multi-layered latticework of necessary operating licenses, the Chinese authorities require social networks and providers of messaging services — Facebook is both — to be willing and able to turn over user data, including account details and the contents of posts and private communications.
Doing the bidding of China’s state security apparatus will put Facebook in a position of collaboration that goes far beyond what any prominent U.S. tech company has agreed to. 

The contrast with Google is instructive. 

In 2006, Google entered China as a search engine — an “internet content provider,” in the taxonomy of Chinese regulators — but deliberately excluded from its China-licensed sites any services that entailed individual user data or private communications. 

In that way, Google subjected its China-directed search engine to censorship requirements but avoided any obligation to comply with surveillance requests from a government prone to human rights violations. (Beyond an abstract revulsion at the prospect of assisting political persecution, we had watched with horror the imprisonment of Chinese journalist Shi Tao after Yahoo’s Hong Kong subsidiary handed over to Beijing the contents of his email account.)
But that’s not even the worst of it. 

The very nature of a social network means that updates and communications written by non-Chinese users will become visible to Chinese security services.

A Facebook user’s newsfeed is the set of updates and shares posted by her/his friends, including many written by friends of friends. 

If a non-Chinese user has a Chinese friend — or, given how Facebook works, even a Chinese friend of a non-Chinese friend — anything that non-Chinese user posts to Facebook could be read by Chinese state security. 

Likewise, if a Chinese user likes or comments on a post by a non-Chinese user, that entire thread becomes attached to the Chinese user’s account and thus subject to Chinese governmental examination.
Because of the permeable, fluid, and semi-public sharing dynamics inherent to Facebook, I can think of no technical or policy means by which the company’s Chinese subsidiary could shield non-Chinese users’ posts, comments, likes, and shares from disclosure to Chinese state security.
Second, there is little chance Facebook can actually succeed in China. 

Even if the Chinese government would permit a foreign tech company to win in a space as important as social networking (and past experience strongly indicates it will not), Chinese users have exhibited strong disinterest in local Facebook knockoffs, and there is little reason to think a foreign player will fare any better.
From eBay to Amazon to Google to Uber, the Chinese government’s initial red-carpet welcomes to Silicon Valley companies have invariably morphed into grinding wars of attrition in which local competitors collude with officials and regulators to ensure the foreigners’ long-term market failure. 

Plus, Facebook will have to surrender a large degree of control over its Chinese service to whatever local partner ends up owning 51 percent of the licensed Chinese entity, as required by Chinese law. 

The experiences of other Silicon Valley entrants indicate that those kinds of joint ventures most often end in frustration and acrimony. (It’s plausible, but too early to conclude, that LinkedIn will prove the exception to that rule.)
I’m surprised, in short, that Facebook would risk sparking outrage and reputational damage among its non-Chinese users (for crossing a line of collaboration that would render their posts, comments, likes, shares, and private messages vulnerable to Chinese government spying) in order to take a crack at a market in which it’s highly unlikely to succeed.

Kaiser Kuo, host, The Sinica Podcast:
Given China’s increasingly strict internet censorship, it should surprise no one that any re-entry by Facebook would be conditional not only on the company’s acquiescing to censorship but also on its demonstrating the ability to carry it out to Beijing’s satisfaction. 

Equally if not even more troubling would be the requirement, all but inevitable, that Facebook store Chinese user data on servers in China, making that data accessible to Chinese courts and law enforcement. 

Even if Beijing deigns to allow Facebook a presence in China, Facebook will face a firestorm of criticism from human rights and data privacy activists.
It will defend its decision by invoking the same logic that U.S. proponents of engagement have always deployed. 

Some connectivity is surely better than none, which is essentially what Facebook has today: a tiny, inconsequential handful of China’s more than 700 million internet users are regular users of platforms like Facebook or Twitter. 

Facebook probably won’t make its case by suggesting that connecting China will bring about political change; it was, after all, suspicion of that sort of thing that got it blocked in the first place. 

It may instead point to the inherent good in connectedness and note the evil — mistrust and misunderstanding — that arises in its absence. 

All this justifies compromise.
Google faced a similar dilemma when it decided to enter China in early 2006. 

But the moral calculus has shifted in the intervening decade. 

Google may have been viewed with suspicion even then, but now — after various Color Revolutions and Arab Spring uprisings with the names of U.S. internet properties conveniently appended to them by the U.S. media — Beijing will exact far greater compromise. 

China blocks far more foreign websites, and blocks them more aggressively, than it did then. 

Chinese users have excellent alternatives: social media platforms where their friends already are. 

They aren’t clamoring for Facebook, and those who want it have little trouble hopping the Great Firewall to get to it: Nationalists bent on trolling pro-independence Taiwanese celebs hopped the wall in droves this past summer, after all. 

So Facebook has little leverage to speak of; it will play by Beijing’s rules or not at all.
Indeed, Facebook’s only real card is the public relations value to Beijing of letting the company in: “See? All that nonsense about censorship was clearly overblown.”

But it’s not. 

One of the regrettable effects of our use of the “Great Firewall” as a metonym for Chinese internet censorship is that too many people equate censorship with the blocking of sites such as Google, Facebook, Twitter, and YouTube. 

In fact, the censorship of domestic Chinese sites is far more onerous and impacts a far greater number of users. 

That won’t change with a Facebook entry.
Whatever your posture toward Facebook for its willingness to compromise on freedom of expression in the name of engagement and greater global connectivity, the unblocking of Facebook to users in the People’s Republic of China, should it come to pass, must not be construed in any way as a loosening of censorship.

Per un pugno di renminbi

Facebook could pay heavy price if it censors news to please China

By Sherisse Pham

HONG KONG -- Facebook's latest signal that it's willing to play ball with China? 

It has quietly built a censorship tool that would keep certain posts out of people's news feeds, according to The New York Times.
CEO Mark Zuckerberg has made no secret of his desire to get the giant social network unblocked in the world's most populous nation.
He has traveled to China repeatedly, meeting with the country's propaganda chief during a visit earlier this year and taking heat on social media for "pandering" to the government by jogging through polluted Beijing streets without a face mask. 

He is even studying Mandarin.
And now his company has apparently developed software that stops posts from appearing in users' news feeds in specific geographic regions, a move specifically aimed at helping the company get into China, The New York Times reported, citing current and former Facebook employees.
A Facebook spokeswoman did not deny the report, saying only that the company has "not made any decision on our approach to China."
"We have long said that we are interested in China, and are spending time understanding and learning more about the country," she said.
The report comes at a sensitive time for Facebook. 

Zuckerberg insists he does not want to play the role of an editor, yet he recently announced plans to help prevent fake news being shared on Facebook just days after playing down the problem.
Analysts say the U.S. tech giant could have a lot to lose by compromising with China, where some other big internet platforms like Twitter and Google are also blocked.
For one thing, censorship alone is unlikely to be enough. 

Facebook would have to give China access to its servers to be allowed in the country, said Qiao Mu, professor of communications at Beijing Foreign Studies University.
"You have a deal with a monster," Qiao said.
Facebook would have to comply with China's tough legal requirements for handing over user information to authorities. 

American businesses have criticized a new Chinese cybersecurity law, warning its requirements for data sharing could expose personal information.
Creating a censorship program to appease China could also undermine the trust of non-Chinese users.
"It has potential to call into question the ethics of the company, call into question whether if you're doing that (in China) ... what are you doing with my content?" said Mark Natkin, managing director at market research firm Marbridge Consulting in Beijing.
By making such a tool available in China, Facebook could face pressure from other governments around the world to implement it elsewhere.
Even if Facebook does enough to satisfy the Chinese government, it would face huge competitive hurdles.
Facebook clones like Renren and Kaixin have already long gone out of fashion China. 

The dominant players now are WeChat and Weibo, both hugely popular social networking sites with hundreds of millions of users.
Facebook, the world's largest social network, would in theory offer Chinese users the possibility of connecting with people all around the globe. 

WeChat and Weibo haven't been able to replicate their success outside of China.
But Chinese internet users who really want to get on Facebook can already do so through a Virtual Private Network, or VPN, which enables them to skirt China's huge censorship apparatus known as the Great Firewall.
"I don't think people even care," Natkin said. 

He summed up the likely response from many Chinese people as, "You came to China, good for you. I'm not going to use you anyway."