(Photo by Kevin Frayer/Getty Images)
The Department of Homeland Security's top priority is stopping China from tampering with the US supply chain, including 5G networks, so Chinese technology vendors should brace for more pushback from the US government, a DHS official said today.
"It all boils down to trust. If I don't trust it, I'm not going to use it," Christopher Krebs, director of DHS's Cybersecurity and Infrastructure Security Agency (CISA).
However, the agency doesn't necessarily plan to target individual vendors. "When I think about supply chain and risk management, we're trying to not take a whack-a-mole approach," Krebs said in a Q&A session on Tuesday at the RSA security show. " We are trying to create a framework for procurement or acquisition."
(Christopher Krebs, director of DHS's Cybersecurity and Infrastructure Security Agency)
To create the framework, DHS established a task force last summer to investigate how the US can address supply chain risks. The work has involved coming up with criteria that companies and institutions can use to select qualified bidders for projects and designing incentives to get companies to buy from secure manufacturers.
Still, the framework could end up putting Chinese vendors at a key disadvantage when selling to US buyers. According to Krebs, the agency has been focused on boiling down the risk factors to the "transparency" and "trust" of the supplier, and whether they are beholden to a foreign government.
DHS took the same approach in 2017 when it issued a directive calling for federal agencies to remove software from antivirus provider Kaspersky Lab because the Moscow-based Kaspersky had access to US federal government data and was beholden to the Russian government.
"I don't tend to trust the Russian legal system," Krebs said. "So that gave me pause. That meant these (Russian) military intelligence services theoretically had access to (US) federal networks."
Krebs suggested the same logic will apply to Chinese vendors such as Huawei. The company has been trying to sell its 5G networking technology to mobile carriers worldwide only to face resistance from the US. Federal officials are worried Huawei's technology could one day be exploited by the Chinese government to secretly spy on Americans and on the communications of US allies.
Krebs said DHS is working on a "threat assessment" on the supply chain risks surrounding the technology as a guidance to the US industry and Congressional leaders. It's also designed to be vendor-agnostic. But DHS does plan on factoring "trust" into the security equation.