Forgot your password?
typodupeerror
China Australia Security The Military United States Hardware IT Politics

Several Western Govts. Ban Lenovo Equipment From Sensitive Networks 410

Posted by timothy
from the this-far-and-no-farther dept.
renai42 writes "If you've been in the IT industry for a while, you'll know that Lenovo's ThinkPad brand has a strong reputation with large organisations for quality, dating back to the brand's pre-2005 ownership by IBM. However, all that may be set to change with the news that the defence agencies of key Western governments such as Australia, the US, Britain, Canada and New Zealand have banned Lenovo gear from being used in sensitive areas, because of concerns that the Chinese vendor has been leaving back doors in its devices for the Chinese Government. No evidence has yet been presented to back the claims, but Lenovo remains locked out of sensitive areas of these governments. Is it fearmongering? Or is there some legitimate basis for the ban?"
This discussion has been archived. No new comments can be posted.

Several Western Govts. Ban Lenovo Equipment From Sensitive Networks

Comments Filter:
  • Their loss (Score:5, Insightful)

    by AmiMoJo (196126) * <mojo@woCURIErld3.net minus physicist> on Monday July 29, 2013 @08:08AM (#44410983) Homepage

    Thinkpads are very popular with people who need to do their own maintenance. They use them on the ISS for that very reason. Every part is replaceable and you can download a full service manual with excellent step-by-step illustrated instructions.

    Sounds like fear of the boogyman and a bit of racism are really going to hurt the US in the long run.

    • Re:Their loss (Score:5, Insightful)

      by MickyTheIdiot (1032226) on Monday July 29, 2013 @08:13AM (#44411009) Homepage Journal

      Is it racism to be concerned that our military is using computer parts that can't (or won't) be produced at home?

      If we had to go to "total war" tomorrow like we had to after Pearl Harbor I think we would be in pretty big trouble if our enemy was from the east and all of our sudden our constant shipping was gone. It we Americans are so damn expensive and corporations are at their height of greed and power we've pretty much forgotten how do that manufacturing.

      • Re:Their loss (Score:4, Insightful)

        by stevegee58 (1179505) on Monday July 29, 2013 @08:27AM (#44411089) Journal
        Anyone says anything bad about China/Chinese and some PC do-gooder brings up race.
        It isn't about race, it's about the proven track record of a government tainting their country's products with viruses, trojans and backdoors.
        • Re:Their loss (Score:5, Insightful)

          by moronoxyd (1000371) on Monday July 29, 2013 @08:33AM (#44411117)

          Proven track record?
          Please enlighten me and give me links to that proof of backdoors. (That's what this is about, not virii or trojans.)

          All I heard on this matter are accusations without any proof.
          On the other hand, we KNOW that the US is spying on everybody...

        • Re:Their loss (Score:5, Insightful)

          by tylikcat (1578365) on Monday July 29, 2013 @08:38AM (#44411141)

          Well, and let's talk about the US record of viruses (as I believe that's better documented than anything else out there)...

          • Yeah, it's not a matter of moral superiority, the U.S. has basically none of that left anywhere, it's about realpolitik. Assume every rival is out to get you as much as you're out to get them, and then some.

        • by Opportunist (166417) on Monday July 29, 2013 @09:06AM (#44411337)

          Erh... the only country that has a proven track of spying on other countries recently is one that has troubles getting its snow back to its den. And while a large portion thereof belongs to China, it's not quite the same country ... yet.

        • Re:Their loss (Score:4, Insightful)

          by myowntrueself (607117) on Monday July 29, 2013 @09:09AM (#44411361)

          Anyone says anything bad about China/Chinese and some PC do-gooder brings up race.

          It isn't about race, it's about the proven track record of a government tainting their country's products with viruses, trojans and backdoors.

          The fact that they play the race card just makes them look more guilty.

      • by pmontra (738736)
        If both parties have too much to lose there won't be another war. That's a fortunate consequence of globalization.
        • If both parties have too much to lose there won't be another war. That's a fortunate consequence of globalization.

          The problem with that is there is no way to calculate what priorities the other side will use to calculate when they have "too much to lose."

        • Re:Their loss (Score:5, Insightful)

          by Kjella (173770) on Monday July 29, 2013 @09:13AM (#44411399) Homepage

          If both parties have too much to lose there won't be another war. That's a fortunate consequence of globalization.

          Before WWII I'm sure you could have made many reasonable and credible arguments for why Germany would never attack France or why Japan would never attack the US that are equal or better to "globalization". Many wars have started small and escalated quickly and unpredictably, whether it's North and South Korea, Taiwan, those islands south of Japan or whatever one match can start a kindle that'll start a fire to put the world in flames. I mean it's not like anyone saw the US getting involved because a dictator started annexing a few areas around Germany. In retrospect you can say the Mutually Assured Destruction policy worked in the Cold War but during the Cuban missile crisis.it was a very close call.

          Maybe your perspective is different but my country of Norway took the neutrality route in the 1930s, no military build-up, no signs of military aggression, we were seeking a position of neutrality and being a non-threat to everybody. What happened was the Nazis said "thank you very much" and invaded with minimal resistance. And today I see the same, with the NATO alliance and Russia being a shadow of its former military might we're running the defense with half a skeleton crew on outdated equipment, we're spending some money on elite units for operations abroad but the mass defense? We'd fall like a house of cards, all the money is bet on their not being any war in the first place.

          • by pmontra (738736)
            Predictions are always difficult especially about the future, right? :-)
            Taking that for granted, what I see now is a world much more interdependent than the one we lived in 1914 and 1939. Stronger countries are buying weaker ones in Europe now instead of sending their armies marching on the ruins of the enemies like they did for the last four or five millenia. That's much more efficient: you get loot and don't have to pay for an army and for reconstruction expenses at home. WW2 have been pretty destructive
          • by Rockoon (1252108)

            Before WWII I'm sure you could have made many reasonable and credible arguments for why Germany would never attack France or why Japan would never attack the US that are equal or better to "globalization".

            Really?

            You seem to be completely uneducated about WWII.

            Perhaps you think that the demands upon Germany for "reparations" after WWI, such as impossible amounts of coal being delivered to the French, was "globalization."
            Perhaps you think that when the U.S. froze all Japanese assets in the U.S., and then threatened an oil embargo against them (which accounted for 80% of the oil they imported), that was "globalization" too.

            Germany attacked France because the French were complete assholes after WWI.
            Jap

            • by Duhavid (677874)

              Agreed with most of it.
              The French really were quite stupid. And if you look a bit farther back, Germany and France had been doing these harsh reparations with each other for a long time after their various conflicts. Wilson was trying for a good settlement to the issues, but the European (especially Clemenceau) leaders wanted to be harsh.

              On the Japanese attack on the US, the US did the oil ( and steel and other "strategic" items ) embargo because Japan had invaded China.
              Japan knew another way to get the o

          • by Grishnakh (216268)

            The neutrality thing doesn't work well unless you arm yourself to the teeth to back it up, the way Switzerland did (and still does). Back in WWII times, they had all their bridges rigged with explosives in case of German attack, there were anti-aircraft cannons hidden in barns, and of course the entire male population is issued a rifle and trains in the militia.

            If you declare yourself to be neutral and non-violent, someone is just going to come in and walk all over you at some point.

      • by Arrepiadd (688829)

        Is it racism to be concerned that our military is using computer parts that can't (or won't) be produced at home?

        If we had to go to "total war" tomorrow like we had to after Pearl Harbor I think we would be in pretty big trouble if our enemy was from the east and all of our sudden our constant shipping was gone. It we Americans are so damn expensive and corporations are at their height of greed and power we've pretty much forgotten how do that manufacturing.

        Because if you just buy Apple computers the problem magically gets solved? Aren't Macs produced in China? What about other companies (HP, Dell, etc.)? Which of them still produce the entire laptop (motherboard, RAM, SSD/HDD, etc.) in the US?

      • Calm down, there is no reason China would like to engage a total war against its principal customer. For sure it would like to get some industrial advantages and tactical advantages on resources, however, it would not be a good idea to destroy its customer base.
      • by Anonymous Coward

        We dispense of the messy and "expensive" tasks of manufacturing and delegate to the lowest cost labor force. Makes sense untill one needs to be able to defend oneself. Once war does not make financial sense, we might be OK. Not sure if we can count on that though.

      • Re:Their loss (Score:4, Insightful)

        by Grishnakh (216268) on Monday July 29, 2013 @11:15AM (#44412569)

        Is it racism to be concerned that our military is using computer parts that can't (or won't) be produced at home?

        No, which is why the US government should only use US-made computers, made with only US-made components.

        Oh wait, there is no such thing. But that's OK, they can pass such a law, and since no computers or electronics are actually made in the US any more, the US government can just go back to using pencils and paper (no copy machines either, since those aren't US-made either).

    • Re: (Score:3, Insightful)

      by felixrising (1135205)
      Sounds like capitalism at work.. working through our governments and spy agencies to lock out a major supplier/s from contract deals.
    • Re:Their loss (Score:5, Insightful)

      by dintech (998802) on Monday July 29, 2013 @08:15AM (#44411013)
      I think the Chinese probably have a lot more to fear from using American technology than the reverse.
      • Re:Their loss (Score:5, Insightful)

        by bfandreas (603438) on Monday July 29, 2013 @08:25AM (#44411077)
        This is hardly new. IIRC Huawei also had similar issues.

        Worse is yet still to come. Given the extent of backdoors, data sharing and data sniffing as has been exposed during the last couple of weeks a lot of service providers in the US may suffer a similar fate. All these service providers operate on trust and trust is at an all time low.

        Now all I have to say when a customer/PHB talks about "cloud" is to counter their BS bingo with "trust". And trust is easier lost than earned.
        The intelligence community in the US, UK and Europe have managed to sow the seed of distrust into everything that is connected to the net. While Joe Public doesn't seem to care, those who do have to care will think twice. The new bonanza will be security/privacy technology while the clouds disperse in the corporate sector.
        • by Anonymous Coward on Monday July 29, 2013 @08:39AM (#44411149)

          And trust is easier lost than earned.

          Indeed. I was trusting the NSA to backup all my data, and now they cannot even find their own emails. I guess I'll have to do my own backup, after all. ;-)

          • by CaptSlaq (1491233)

            And trust is easier lost than earned.

            Indeed. I was trusting the NSA to backup all my data, and now they cannot even find their own emails. I guess I'll have to do my own backup, after all. ;-)

            Comedy gold.

      • by Jawnn (445279)

        I think the Chinese probably have a lot more to fear from using American technology than the reverse.

        Bullshit. When was the last time, no. Make what when have you ever heard of a vendor loading it's network hardware with gear that spies on behalf of the U.S. government? Not that those fuckers don't spy too, but they're a lot more up front about it. "Yeah, we have all the details about every phone call, text, and web search you've ever made. What are you gonna do about it?" Still, that's a far cry from embedding surveillance functionality in my laptop.

      • by wmac1 (2478314)

        Exactly. I see near future in which Asian countries will no more trust in US, UK and western built equipments.

        This has already begun. Indonesia and a few other countries have already started banning US and UK services and products.

    • Re: (Score:3, Insightful)

      by Anonymous Coward

      ...bit of racism...whatever. I find it funny that you point out the US in your comment, but totally ignore the other big countries also banning Lenovo...

      sounds like you're anti-US (since we're throwing out generalizations).

    • by cdrudge (68377)

      Thinkpads are very popular with people who need to do their own maintenance. They use them on the ISS for that very reason. Every part is replaceable

      What part on non-Lenovo (or earlier non-IBM) laptop is not replaceable? Every laptop I've owned that has had something break I've been able to find a replacement part for it.

      Presuming you're talking about factory service type of work, it's not exactly like you're swapping out individual components on circuit boards. Modern laptops aren't that much more than a

    • Not really. I am a old afficionado of the Thinkpad brand. When Lenovo bought the brand I got a T61p which died prematurately after the guarantee expiration. The problem was with the Nvidia graphics processor and it wasn't replaceable. The whole system board needed to be replaced at a price much higher than a brand new laptop. I did remove every part in this laptop and it wasn't that easy as it once was with older Thinkpads and other brands from the Big Blue.

      I believe the Thinkpad brand is slowly changing an

    • by Lisias (447563)

      Sounds like another fear of the boogyman and more racism are really going to hurt the US in the long run.

      Here, I fixed that for you.

    • Really? The U.S. did it to Soviet Union back in the early '80s. So it's very possible if not likely that other governments would try the samething.

      When you are dealing with sensitive information, you error on the side of caution. You would have to be a complete moron to do otherwise.
    • I wasn't aware the US had annexed Canada, Australia, New Zealand, and the UK. ...or are you just trying to spin something as anti-US when really it is a collection of nations?

    • Re:Their loss (Score:4, Insightful)

      by jellomizer (103300) on Monday July 29, 2013 @08:58AM (#44411287)

      I am not sure why you just don't test the device. Every device if security is that big of a concern.
      I mean it is a freaking man made computer not a Magic Box.

      Plug it into an isolated network that looks like a Wan connection with some honey pots. And see what the heck it is sending with some simulated use. You can check the hardware to see what type of wireless transmitters it has installed. Put it in a Faraday Cage and monitor what stuff it is sending out wirelessly.

      Also if security is a concern. Why would you leave the default image that came with the PC, you should do a clean install of your "trusted" OS with the software you want.

      Besides if the Chinese wants to spy on us. They don't need to send us computers with hack in it. Most IT departments are so incompetent (Usually upper middle management who is unwilling to pay for the necessary upgrades until there is a problem) that they will leave gaping holes to get in.

      While Think Pads are Black Boxes, there isn't anything magical about them. They are boxes that happen to be black, with normal PC stuff in them and compared to other models much easier to dissemble and have every part checked out.

      I would be more worried about your smartphone. This thing has sends stuff wireless by design. And it relatively slow processor means security holes my be in the system as a trade-off to get a little extra performance out of it.

      • by jeff4747 (256583)

        Why do you assume the spy software would be turned on during that testing? Have the software do nothing for the first 6 months of operation, and your tests will not reveal it.

        Why do you assume the spy software is installed on the hard drive, where re-imaging might eliminate it? There's lots and lots of other places to put code that will be executed by the processor.

        Tip: The folks at the NSA and other nation equivalents that come to the conclusion in TFA are not morons.

    • by tibit (1762298)

      Hurt "the US"? What the heck are you talking about? Given the scale the PCs are deployed at, nobody repairs them. Nobody. I mean we're talking less than 1 in 1000 PCs ever being repaired, even if it'd be a software repair only! Even PCs that have fully functional hardware are thrown away because they "become slow and crash often" - read: they are malware infested, nothing wrong with the hardware at all.

      It's being deluded to think that the repairability of the PC affects anyone but the geeks and data center

      • Given the scale the PCs are deployed at, nobody repairs them. Nobody. I mean we're talking less than 1 in 1000 PCs ever being repaired, even if it'd be a software repair only!

        Where the hell do you work? I work for a company that makes PC Lifecycle Management software (amongst other things). I'm in contact with many IT guys at many companies across many verticals. They re-image all the time. Replace bad RAM, bad drives. Replace cracked displays, replace coffee-filled keyboards... On an on. No one ha

    • Re:Their loss (Score:4, Insightful)

      by fafaforza (248976) on Monday July 29, 2013 @09:00AM (#44411303)

      I have 4 ThinkPads, and wish you hadn't used 'racism', as it negates most of what you said. There's lots of hacking going on from China, targeting Boeing and Lockheed Martin. And most wouldn't put it past their government to do what's "necessary" to catch up to the west, and the Chinese government has lots of control over their corporations. So it isn't outlandish to be concerned about the hardware placed in sensitive areas.

      I think it's more of a boogyman and fearmongering to start calling people/nations racist.

  • So instead? (Score:5, Insightful)

    by John Burton (2974729) on Monday July 29, 2013 @08:09AM (#44410987)
    So I wonder which manufacturer that doesn't use Chinese components they'll use instead?
    • Re:So instead? (Score:5, Insightful)

      by SJHillman (1966756) on Monday July 29, 2013 @08:16AM (#44411019)

      Having components from China is different from having the entire machine, or at least key parts that can phone home, from China is very different. They don't give a damn if your capacitors or even the entire DVD drive are from China.

      • Re: (Score:2, Insightful)

        by nucrash (549705)
        Main components like the mainboard? BIOS or ufi? No one could ever put a phone home program in a small bit like the network/wireless adapters. That would never happen.
        • Not easily (Score:4, Interesting)

          by Sycraft-fu (314770) on Monday July 29, 2013 @08:51AM (#44411241)

          The motherboard may be made in China but the components are not. The chips are largely American in manufacture (most of them are Intel). Now I suppose the company making the motherboards could add a chip, but, well, that would kinda be noticed during the QA process by the company that ordered them. It isn't like you get parts from a Chinese manufacturer and just slap them in a unit sight-unseen. Not because of worries about spying but because quality control with Chinese companies can be... problematic. You have to test the parts and send back the failed ones (1%ish usually, sometimes more).

          In terms of BIOS/UEFI? That's all Phoenix Technologies and American Megatrends. They are in California and Georgia respectively.

      • by Trepidity (597)

        Most western-designed machines also have final assembly in China, in addition to the components mostly being made in China. For example, HP assembles many of its laptops in Chongqing in a joint facility [bloomberg.com].

        There might be some difference, since the design is done by HP, and they oversee the production to try to ensure it's in accordance with their design. I'm not sure how much of a barrier to slipping something in that provides, but it might be nonzero.

    • by tlhIngan (30335)

      That explains why Apple is moving some Macs to be Made in the US. And not just "Assembled in the US" either - the new forthcoming Mac Pro is supposed to use a lot of US manufacturing. About the only Chinese components would be sold in component form - the PCB, chassis and assembly are all to be done in the US so it actually qualifies as "Made in the USA" and not just "Assembled in the USA".

  • No evidence has yet been presented to back the claims...
    Is it fearmongering?
    Or is there some legitimate basis for the ban?

    How would we know whether or not evidence exists? All we know is that we haven't seen any. Time will tell. If no evidence is preseneted in the next month or so, then we'll know that it's just fearmongering, and not a legitmate basis for a ban.

    • Just because there's no evidence doesn't mean something isn't true. There's no evidence of life currently on Mars, but that doesn't mean there definitely isn't life on Mars. A lack of evidence just means a lack of ability to prove something one way or another.

  • by nweaver (113078) on Monday July 29, 2013 @08:19AM (#44411043) Homepage

    The problem is the credible fear of a lifecycle attack is sufficient to require that such hardware be avoided. There is a reasonable fear that the chinese might try something using Lenovo kit, therefore the classified networks need to avoid it. Its the same reason why Huawei networking hardware is avoided in some circles.

    Of course, with the NSA now clearly off the leash, US IT equipment is now in the same position. Microsoft clearly backdoored Skype to enable easy wiretapping, the NSA is reportedly hacking foreign networks to introduce monitoring (who knows, perhaps it was the NSA responsible for the Athens Affair [ieee.org]?), and with any US Cloud service provider subject to PRISM-style requirements, US IT infrastructure is now in the same boat that the Chinese have been struggling with for years now.

    • by Tridus (79566)

      It's also the future of every US based cloud service provider. As much as US trade reps around the world want to whine about how unfair it is that people in other countries avoid American service providers, it's only going to get worse. The US government is the worst enemy of those companies.

  • New Cold War (Score:4, Insightful)

    by nebular (76369) on Monday July 29, 2013 @08:19AM (#44411045) Homepage

    The new cold war will be electronic and China has already proven that they are willing to do whatever is necessary to stay ahead there.

    This isn't racism, this is a forward looking policy that's saying when, not if but when, we start finding Chinese backdoors in our equipment, they won't be in our sensitive areas.

    The down side is that even if our equipment says made in the USA, it means assembled. Most of the parts will have been manufactured in China.

  • I hope all non-US companies similarly decide to not use US-based vendors, given that there is greater likelihood that the NSA has back doors. What do you think those 200MB HP printer drivers are for, after all?
    • Most of that 200MB has nothing to do with drivers. Do what anyone in IT does if that 200MB download is the only driver package available... download it, open the executable up with your favorite ZIP program and extract just the folder containing the actual print drivers. You don't need the rest of the software for printing.

    • Re:In that case... (Score:4, Informative)

      by Anonymous Coward on Monday July 29, 2013 @08:33AM (#44411115)

      Unlike most US companies, The Chinese government owns the largest share (38%) of Lenovo's parent company Legend which owns the largest share of Lenovo (34%).

      FYI it was the British and Australian defense and intelligence communities that discovered malicious modifications to Lenovo's circuitry. Just in case you actually believe that the US intelligence was proactive for once, it was the British intelligence findings that encouraged congress to react.

      • You ruined his perfectly good "hate on the US" session! After all, clearly the US is the bad guy if they are doing this. The other countries must have good reasons and/or are just US puppets, it is the US that is evil!

        It is amusing how two posters in this thread so far have tried to spin this in to an anti-US rant, when it is rather something happening in a number of nations. On Slashdot, it seems to continue to be trendy to hate on the US, for any or no reason at all.

  • Microsoft and Cisco.

  • If there is no evidence, then yes it is scaremongering. Stuxnet and Spying on their own civilians, well for that there is evidence.

  • All the Chinese need to do is gain access to the NSA backdoors that are in all versions of Windows... That would be far more efficient.. and undoubtedly they already have..

  • Someone important's cousin just bought the competition to Lenovo.

  • What a load of crap (Score:5, Interesting)

    by sirwired (27582) on Monday July 29, 2013 @08:53AM (#44411253)

    There isn't a single US manufacturer of motherboards any more; that would be the most sturdy place to insert any nefariousness (at least, nefariousness by the PC manufacturer.) Who knows where BIOS code is written these days; but I doubt it's the US.

    Not to mention the whole stack of drivers you need, like those for on-board peripherals. It'd be just as easy to put a back-door in a Windows I/O driver as it would the BIOS.

    • by Arker (91948)

      "It'd be just as easy to put a back-door in a Windows I/O driver as it would the BIOS."

      Much easier actually, trivial drivers are often quite bloated and there is plenty of space to hide stuff in. BIOS spaces still tend to be tighter and get more scrutiny.

  • by dogsbreath (730413) on Monday July 29, 2013 @08:59AM (#44411291)

    Well now, it's been my keen observation over the years that people suspect of others the same nefarious behaviour that they indulge in themselves or would do given the opportunity. I am sure that there exist proposals to have Cisco/Juniper/Akami network gear do more than is advertised.

    Knowing that the West intelligence services would do (are doing??) what Lenovo & Huawei are suspected of is enough to have those companies banned, at least in CIA/NSA thinking.

    It's difficult enough to keep malware out of the network as it is without providing an easy doorway.

    eg: stuxnet

    However, if evaluation of the policy to ban Lenovo were up to me, I would do a serious risk evaluation and compare Lenovo to others such as Dell. Truth is that state sponsored malware could be introduced at many levels including embedded firmware in say, network or video chipsets.

    I suspect that the multinational component sourcing makes banning Lenovo analogous to plugging a small hole in a screen door while leaving all the windows open.

  • To find your answer, what brand are the paranoid Chinese using?

    Simple, right?

  • Strong reputation? (Score:4, Informative)

    by Vrtigo1 (1303147) on Monday July 29, 2013 @10:16AM (#44411917)
    I don't exactly work for a large organization, but we do have folks working all over the world so service and support is very important to us. We had been using Dell but switched to Lenovo for a year because we could get systems from them with less lead time. We couldn't switch back fast enough. We paid extra for 3 year onsite NBD warranties (vs return to depot warranties) but when we called Lenovo to get them to send someone out for a repair, it always turned into an argument about whether we were entitled to onsite service.

    Dell has always had excellent service, over the past 10 years or so I can probably count the number of times they didn't have a hardware problem fixed the next business day on one hand. It also seemed like we had a higher incidence of problems with the Lenovo systems. We bought maybe 20 of them and of that 20 probably half had to have their system boards replaced because a USB connector snapped off.
  • by WaffleMonster (969671) on Monday July 29, 2013 @10:27AM (#44412049)

    This seems to be about politics and or irrational fear. Components for modern laptops are sourced from all over the world any number of which could be capable of any number of wicked things. If your goal is to mitigate risk from foreign governments then simply picking a new laptop vendor is not an effective solution.

    Why not produce your own computers on the NSA fab? You know...put it to use use for something other than spying on your own people.

The clearest way into the Universe is through a forest wilderness. -- John Muir

Working...